recog 2.0.13 → 2.0.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CONTRIBUTING.md +19 -6
- data/features/{xml → data}/failing_banners_fingerprints.xml +0 -0
- data/features/{xml → data}/matching_banners_fingerprints.xml +0 -0
- data/features/{xml → data}/no_tests.xml +0 -0
- data/features/{xml/banners.xml → data/sample_banner.txt} +0 -0
- data/features/{xml → data}/successful_tests.xml +0 -0
- data/features/{xml → data}/tests_with_failures.xml +0 -0
- data/features/{xml → data}/tests_with_warnings.xml +0 -0
- data/features/match.feature +2 -2
- data/features/support/env.rb +1 -1
- data/lib/recog/version.rb +1 -1
- data/misc/order.xsl +17 -0
- data/spec/lib/fingerprint_self_test_spec.rb +8 -0
- data/xml/apache_os.xml +270 -334
- data/xml/architecture.xml +28 -41
- data/xml/fingerprints.xsd +37 -0
- data/xml/ftp_banners.xml +52 -58
- data/xml/h323_callresp.xml +597 -695
- data/xml/hp_pjl_id.xml +370 -409
- data/xml/http_cookies.xml +304 -348
- data/xml/http_servers.xml +3202 -3483
- data/xml/http_wwwauth.xml +342 -409
- data/xml/imap_banners.xml +149 -190
- data/xml/mdns_device-info_txt.xml +97 -111
- data/xml/mdns_workstation_txt.xml +6 -6
- data/xml/mysql_banners.xml +99 -198
- data/xml/mysql_error.xml +4 -11
- data/xml/nntp_banners.xml +42 -45
- data/xml/ntp_banners.xml +2 -3
- data/xml/pop_banners.xml +214 -247
- data/xml/rsh_resp.xml +68 -76
- data/xml/sip_banners.xml +19 -19
- data/xml/sip_user_agents.xml +63 -74
- data/xml/smb_native_os.xml +387 -433
- data/xml/smtp_banners.xml +1318 -1460
- data/xml/smtp_debug.xml +24 -27
- data/xml/smtp_ehlo.xml +19 -22
- data/xml/smtp_expn.xml +61 -70
- data/xml/smtp_help.xml +139 -160
- data/xml/smtp_mailfrom.xml +14 -16
- data/xml/smtp_noop.xml +28 -31
- data/xml/smtp_quit.xml +16 -18
- data/xml/smtp_rcptto.xml +8 -10
- data/xml/smtp_rset.xml +12 -13
- data/xml/smtp_turn.xml +12 -13
- data/xml/smtp_vrfy.xml +66 -76
- data/xml/snmp_sysdescr.xml +7257 -8016
- data/xml/snmp_sysobjid.xml +392 -434
- data/xml/ssh_banners.xml +783 -867
- data/xml/upnp_banners.xml +594 -628
- metadata +11 -9
data/xml/smtp_banners.xml
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
<?xml version="1.0"?>
|
|
1
|
+
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
2
|
<!--
|
|
3
3
|
SMTP greeting lines (part of the banner after the response code) are matched
|
|
4
4
|
against these patterns (1 line at a time) to fingerprint SMTP servers.
|
|
@@ -18,135 +18,120 @@ These XML files are used in this order:
|
|
|
18
18
|
|
|
19
19
|
The system or service fingerprint with the highest certainty overwrites the others.
|
|
20
20
|
-->
|
|
21
|
-
|
|
22
21
|
<fingerprints matches="smtp.banner">
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
<param pos="1" name="host.name"/>
|
|
51
|
-
</fingerprint>
|
|
52
|
-
|
|
53
|
-
<fingerprint pattern="^([^ ]+) SMTP AnalogX Proxy ([^ ]+\.[^ ]+) \(Release\) ready *$">
|
|
54
|
-
<description>
|
|
22
|
+
<fingerprint pattern="^X1 NT-ESMTP Server ([^ ]+) \(IMail (\d+\.[^ ]+) EVAL \d+-\d+\)$">
|
|
23
|
+
<description>IMail EVAL version</description>
|
|
24
|
+
<param pos="0" name="service.vendor" value="Ipswitch"/>
|
|
25
|
+
<param pos="0" name="service.family" value="IMail Server"/>
|
|
26
|
+
<param pos="0" name="service.product" value="IMail Server"/>
|
|
27
|
+
<param pos="2" name="service.version"/>
|
|
28
|
+
<param pos="1" name="host.name"/>
|
|
29
|
+
<param pos="0" name="imail.eval" value="yes"/>
|
|
30
|
+
</fingerprint>
|
|
31
|
+
<fingerprint pattern="^X1 NT-ESMTP Server ([^ ]+) \(IMail (\d+\.[^ ]+) \d+-\d+\)$">
|
|
32
|
+
<description>IMail non-EVAL version</description>
|
|
33
|
+
<param pos="0" name="service.vendor" value="Ipswitch"/>
|
|
34
|
+
<param pos="0" name="service.family" value="IMail Server"/>
|
|
35
|
+
<param pos="0" name="service.product" value="IMail Server"/>
|
|
36
|
+
<param pos="2" name="service.version"/>
|
|
37
|
+
<param pos="1" name="host.name"/>
|
|
38
|
+
</fingerprint>
|
|
39
|
+
<fingerprint pattern="^([^ ]+) \(IMail (\d+\.[^ ]+) \d+-\d+\) NT-ESMTP Server X1$">
|
|
40
|
+
<description>IMail non-EVAL version</description>
|
|
41
|
+
<param pos="0" name="service.vendor" value="Ipswitch"/>
|
|
42
|
+
<param pos="0" name="service.family" value="IMail Server"/>
|
|
43
|
+
<param pos="0" name="service.product" value="IMail Server"/>
|
|
44
|
+
<param pos="2" name="service.version"/>
|
|
45
|
+
<param pos="1" name="host.name"/>
|
|
46
|
+
</fingerprint>
|
|
47
|
+
<fingerprint pattern="^([^ ]+) SMTP AnalogX Proxy ([^ ]+\.[^ ]+) \(Release\) ready *$">
|
|
48
|
+
<description>
|
|
55
49
|
AnalogX proxy
|
|
56
50
|
http://www.analogx.com/contents/download/network/proxy.htm
|
|
57
51
|
</description>
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
<description>
|
|
52
|
+
<example host.name="192.168.1.1" service.version="4.15">192.168.1.1 SMTP AnalogX Proxy 4.15 (Release) ready</example>
|
|
53
|
+
<param pos="0" name="service.vendor" value="AnalogX"/>
|
|
54
|
+
<param pos="0" name="service.family" value="Proxy"/>
|
|
55
|
+
<param pos="0" name="service.product" value="Proxy"/>
|
|
56
|
+
<param pos="2" name="service.version"/>
|
|
57
|
+
<param pos="1" name="host.name"/>
|
|
58
|
+
</fingerprint>
|
|
59
|
+
<fingerprint pattern="^ArGoSoft Mail Server, Version [^ ]+ \(([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+)\) *$">
|
|
60
|
+
<description>
|
|
68
61
|
ArGoSoft Mail Server is fully functional STMP/POP3/Finger server for Windows 95/98/NT/2000.
|
|
69
62
|
http://www.argosoft.com/applications/mailserver/
|
|
70
63
|
Example: 220 ArGoSoft Mail Server, Version 1.4 (1.4.0.3)
|
|
71
64
|
</description>
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
<fingerprint pattern="^ArGoSoft Mail Server Pro for WinNT/2000, Version [^ ]+ \(([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+)\) *$">
|
|
89
|
-
<description>
|
|
65
|
+
<param pos="0" name="service.vendor" value="ArGoSoft"/>
|
|
66
|
+
<param pos="0" name="service.family" value="Mail Server"/>
|
|
67
|
+
<param pos="0" name="service.product" value="Mail Server"/>
|
|
68
|
+
<param pos="1" name="service.version"/>
|
|
69
|
+
</fingerprint>
|
|
70
|
+
<fingerprint pattern="^(\S+) ArGoSoft Mail Server Freeware, Version [^ ]+ \(([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+)\) *$">
|
|
71
|
+
<description>ArGoSoft Mail, freeware version</description>
|
|
72
|
+
<example host.name="example.com" service.version="1.8.8.8">example.com ArGoSoft Mail Server Freeware, Version 1.8 (1.8.8.8)</example>
|
|
73
|
+
<param pos="0" name="service.vendor" value="ArGoSoft"/>
|
|
74
|
+
<param pos="0" name="service.family" value="Mail Server"/>
|
|
75
|
+
<param pos="0" name="service.product" value="Mail Server"/>
|
|
76
|
+
<param pos="2" name="service.version"/>
|
|
77
|
+
<param pos="1" name="host.name"/>
|
|
78
|
+
</fingerprint>
|
|
79
|
+
<fingerprint pattern="^ArGoSoft Mail Server Pro for WinNT/2000, Version [^ ]+ \(([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+)\) *$">
|
|
80
|
+
<description>
|
|
90
81
|
Example: 220 ArGoSoft Mail Server Pro for WinNT/2000, Version 1.61 (1.6.1.8)
|
|
91
82
|
</description>
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
<description>
|
|
83
|
+
<param pos="0" name="service.vendor" value="ArGoSoft"/>
|
|
84
|
+
<param pos="0" name="service.family" value="Mail Server"/>
|
|
85
|
+
<param pos="0" name="service.product" value="Mail Server"/>
|
|
86
|
+
<param pos="1" name="service.version"/>
|
|
87
|
+
</fingerprint>
|
|
88
|
+
<fingerprint pattern="^([^ ]+) +AppleShare IP Mail Server ([^ ]+\.[^ ]+\.[^ ]+) SMTP Server Ready *$">
|
|
89
|
+
<description>
|
|
100
90
|
AppleShare IP Mail Server (3 version numbers)
|
|
101
91
|
</description>
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
<description>
|
|
92
|
+
<param pos="0" name="service.vendor" value="Apple"/>
|
|
93
|
+
<param pos="0" name="service.family" value="AppleShare IP Mail Server"/>
|
|
94
|
+
<param pos="0" name="service.product" value="AppleShare IP Mail Server"/>
|
|
95
|
+
<param pos="1" name="host.name"/>
|
|
96
|
+
<param pos="2" name="service.version"/>
|
|
97
|
+
</fingerprint>
|
|
98
|
+
<fingerprint pattern="^([^ ]+) +AppleShare IP Mail Server ([^ ]+\.[^ ]+) SMTP Server Ready *$">
|
|
99
|
+
<description>
|
|
111
100
|
AppleShare IP Mail Server (2 version numbers)
|
|
112
101
|
</description>
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
<description>
|
|
102
|
+
<param pos="0" name="service.vendor" value="Apple"/>
|
|
103
|
+
<param pos="0" name="service.family" value="AppleShare IP Mail Server"/>
|
|
104
|
+
<param pos="0" name="service.product" value="AppleShare IP Mail Server"/>
|
|
105
|
+
<param pos="1" name="host.name"/>
|
|
106
|
+
<param pos="2" name="service.version"/>
|
|
107
|
+
</fingerprint>
|
|
108
|
+
<fingerprint pattern="^CheckPoint FireWall-1 secure SMTP server *$">
|
|
109
|
+
<description>
|
|
122
110
|
CheckPoint FireWall-1
|
|
123
111
|
</description>
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
<description>
|
|
112
|
+
<param pos="0" name="service.vendor" value="Check Point"/>
|
|
113
|
+
<param pos="0" name="service.family" value="Check Point"/>
|
|
114
|
+
<param pos="0" name="service.product" value="Firewall-1"/>
|
|
115
|
+
</fingerprint>
|
|
116
|
+
<fingerprint pattern="^SMTP/cmap ready_+$">
|
|
117
|
+
<description>
|
|
131
118
|
Cisco Pix v4.x
|
|
132
119
|
</description>
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
<
|
|
140
|
-
|
|
141
|
-
|
|
142
|
-
|
|
143
|
-
|
|
144
|
-
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
<fingerprint pattern="^[\*20 ]+$">
|
|
149
|
-
<description>
|
|
120
|
+
<param pos="0" name="service.vendor" value="Cisco"/>
|
|
121
|
+
<param pos="0" name="service.family" value="PIX"/>
|
|
122
|
+
<param pos="0" name="service.product" value="PIX"/>
|
|
123
|
+
<param pos="0" name="service.version" value="4"/>
|
|
124
|
+
</fingerprint>
|
|
125
|
+
<fingerprint pattern="CCProxy (\S+) SMTP Service Ready(?:\(Unregistered\))?$">
|
|
126
|
+
<description>Youngzsoft CCProxy SMTP</description>
|
|
127
|
+
<example service.version="7.3">CCProxy 7.3 SMTP Service Ready(Unregistered)</example>
|
|
128
|
+
<param pos="0" name="service.vendor" value="Youngzsoft"/>
|
|
129
|
+
<param pos="0" name="service.family" value="CCProxy"/>
|
|
130
|
+
<param pos="0" name="service.product" value="CCProxy"/>
|
|
131
|
+
<param pos="1" name="service.version"/>
|
|
132
|
+
</fingerprint>
|
|
133
|
+
<fingerprint pattern="^[\*20 ]+$">
|
|
134
|
+
<description>
|
|
150
135
|
Cisco PIX firewall: PIX sits between an internal SMTP server and the rest of the world.
|
|
151
136
|
|
|
152
137
|
Its MailGuard feature strips all information out of the 220 header except for the ' ' (space), '2' (digit two),
|
|
@@ -156,251 +141,229 @@ The system or service fingerprint with the highest certainty overwrites the othe
|
|
|
156
141
|
|
|
157
142
|
Search Cisco's documentation for "fixup protocol SMTP" for more information.
|
|
158
143
|
</description>
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
|
|
162
|
-
|
|
163
|
-
|
|
164
|
-
|
|
165
|
-
<description>
|
|
144
|
+
<param pos="0" name="service.vendor" value="Cisco"/>
|
|
145
|
+
<param pos="0" name="service.family" value="PIX"/>
|
|
146
|
+
<param pos="0" name="service.product" value="PIX"/>
|
|
147
|
+
</fingerprint>
|
|
148
|
+
<fingerprint pattern="^([^ ]+) +ESMTP CPMTA-([^ ]+)_([^ ]+)_([^ ]+)_([^ ]+) - NO UCE *$">
|
|
149
|
+
<description>
|
|
166
150
|
Critical Path (aka InScribe) Messaging Server
|
|
167
151
|
http://www.cp.net/products/inscr_messagingserv_overview.html
|
|
168
152
|
Runs on Windows NT4/2k, Solaris 2.6, 2.7, and 2.8 Sparc/Intel, SGI IRIX 6.5.3 or later, and AIX
|
|
169
153
|
</description>
|
|
170
|
-
|
|
171
|
-
|
|
172
|
-
|
|
173
|
-
|
|
174
|
-
|
|
175
|
-
|
|
176
|
-
|
|
177
|
-
|
|
178
|
-
|
|
179
|
-
|
|
180
|
-
|
|
181
|
-
<description>
|
|
154
|
+
<param pos="0" name="service.vendor" value="Critical Path"/>
|
|
155
|
+
<param pos="0" name="service.family" value="Messaging Server"/>
|
|
156
|
+
<param pos="0" name="service.product" value="Messaging Server"/>
|
|
157
|
+
<param pos="1" name="host.name"/>
|
|
158
|
+
<param pos="2" name="service.version"/>
|
|
159
|
+
<param pos="3" name="service.version.version"/>
|
|
160
|
+
<param pos="4" name="service.version.version.version"/>
|
|
161
|
+
<param pos="5" name="service.version.version.version.version"/>
|
|
162
|
+
</fingerprint>
|
|
163
|
+
<fingerprint pattern="^CSM Internet Mail Scanner SMTP-Gateway ready?\. *$">
|
|
164
|
+
<description>
|
|
182
165
|
CSM Internet Mail Scanner SMTP proxy
|
|
183
166
|
see http://www.csm-usa.com/product/ims/release.htm
|
|
184
167
|
TODO: Some versions return a typo "read." instead of "ready." - use this to fingerprint
|
|
185
168
|
example: 220 CSM Internet Mail Scanner SMTP-Gateway ready.
|
|
186
169
|
example: 220 CSM Internet Mail Scanner SMTP-Gateway read.
|
|
187
170
|
</description>
|
|
188
|
-
|
|
189
|
-
|
|
190
|
-
|
|
191
|
-
|
|
192
|
-
|
|
193
|
-
|
|
194
|
-
<description>
|
|
171
|
+
<param pos="0" name="service.vendor" value="CSM"/>
|
|
172
|
+
<param pos="0" name="service.family" value="Internet Mail Scanner"/>
|
|
173
|
+
<param pos="0" name="service.product" value="Internet Mail Scanner"/>
|
|
174
|
+
</fingerprint>
|
|
175
|
+
<fingerprint pattern="^([^ ]+) +IMS SMTP Receiver Version ([^ ]+\.[^ ]+) Ready *$">
|
|
176
|
+
<description>
|
|
195
177
|
EMWAC Internet Mail Services http://emwac.ed.ac.uk/html/internet_toolchest/ims/ims.htm
|
|
196
178
|
example: 220 gabriela.networld.com.ar IMS SMTP Receiver Version 0.83 Ready
|
|
197
179
|
</description>
|
|
198
|
-
|
|
199
|
-
|
|
200
|
-
|
|
201
|
-
|
|
202
|
-
|
|
203
|
-
|
|
204
|
-
|
|
205
|
-
|
|
206
|
-
<description>
|
|
180
|
+
<param pos="0" name="service.vendor" value="EMWAC"/>
|
|
181
|
+
<param pos="0" name="service.family" value="Internet Mail Services"/>
|
|
182
|
+
<param pos="0" name="service.product" value="Internet Mail Services"/>
|
|
183
|
+
<param pos="1" name="host.name"/>
|
|
184
|
+
<param pos="2" name="service.version"/>
|
|
185
|
+
</fingerprint>
|
|
186
|
+
<fingerprint pattern="^([^ ]+) running Eudora Internet Mail Server ([^ ]+\.[^ ]+\.[^ ]+) *$">
|
|
187
|
+
<description>
|
|
207
188
|
Eudora Internet Mail Server (3 version numbers)
|
|
208
189
|
example: 220 interlink.com.ar running Eudora Internet Mail Server 3.0.2
|
|
209
190
|
example: 220 mail.gis.at running Eudora Internet Mail Server 2.2
|
|
210
191
|
</description>
|
|
211
|
-
|
|
212
|
-
|
|
213
|
-
|
|
214
|
-
|
|
215
|
-
|
|
216
|
-
|
|
217
|
-
|
|
218
|
-
|
|
219
|
-
|
|
220
|
-
|
|
221
|
-
|
|
222
|
-
|
|
223
|
-
<description>
|
|
192
|
+
<param pos="0" name="service.vendor" value="Eudora"/>
|
|
193
|
+
<param pos="0" name="service.family" value="Internet Mail Server"/>
|
|
194
|
+
<param pos="0" name="service.product" value="Internet Mail Server"/>
|
|
195
|
+
<param pos="0" name="os.vendor" value="Apple"/>
|
|
196
|
+
<param pos="0" name="os.family" value="Mac OS"/>
|
|
197
|
+
<param pos="0" name="os.device" value="General"/>
|
|
198
|
+
<param pos="0" name="os.product" value="Mac OS"/>
|
|
199
|
+
<param pos="1" name="host.name"/>
|
|
200
|
+
<param pos="2" name="service.version"/>
|
|
201
|
+
</fingerprint>
|
|
202
|
+
<fingerprint pattern="^([^ ]+) running Eudora Internet Mail Server ([^ ]+\.[^ ]+) *$">
|
|
203
|
+
<description>
|
|
224
204
|
Eudora Internet Mail Server (2 version numbers)
|
|
225
205
|
220 mail.gis.at running Eudora Internet Mail Server 2.2
|
|
226
206
|
</description>
|
|
227
|
-
|
|
228
|
-
|
|
229
|
-
|
|
230
|
-
|
|
231
|
-
|
|
232
|
-
|
|
233
|
-
|
|
234
|
-
|
|
235
|
-
|
|
236
|
-
|
|
237
|
-
|
|
238
|
-
|
|
239
|
-
<!-- your.smtp.server ESMTP Server (Microsoft Exchange Internet Mail Service 5.5.2448.0) ready -->
|
|
240
|
-
<description>
|
|
207
|
+
<param pos="0" name="service.vendor" value="Eudora"/>
|
|
208
|
+
<param pos="0" name="service.family" value="Internet Mail Server"/>
|
|
209
|
+
<param pos="0" name="service.product" value="Internet Mail Server"/>
|
|
210
|
+
<param pos="0" name="os.vendor" value="Apple"/>
|
|
211
|
+
<param pos="0" name="os.family" value="Mac OS"/>
|
|
212
|
+
<param pos="0" name="os.device" value="General"/>
|
|
213
|
+
<param pos="0" name="os.product" value="Mac OS"/>
|
|
214
|
+
<param pos="1" name="host.name"/>
|
|
215
|
+
<param pos="2" name="service.version"/>
|
|
216
|
+
</fingerprint>
|
|
217
|
+
<fingerprint pattern="^([^ ]+) +ESMTP Server \(Microsoft Exchange Internet Mail Service (\d+\.\d+\.\d+\.\d+)\) ready *$">
|
|
218
|
+
<description>
|
|
241
219
|
Microsoft Exchange Server 5.5 and above
|
|
242
220
|
(for sure, can't be confused with the IIS builtin SMTP service)
|
|
243
221
|
</description>
|
|
244
|
-
|
|
245
|
-
|
|
246
|
-
|
|
247
|
-
|
|
248
|
-
|
|
249
|
-
|
|
250
|
-
|
|
251
|
-
|
|
252
|
-
|
|
253
|
-
|
|
254
|
-
|
|
255
|
-
|
|
256
|
-
<!-- your.smtp.server Microsoft Exchange Internet Mail Service 5.0.1460.8 ready -->
|
|
257
|
-
<description>
|
|
222
|
+
<param pos="0" name="service.vendor" value="Microsoft"/>
|
|
223
|
+
<param pos="0" name="service.family" value="Exchange Server"/>
|
|
224
|
+
<param pos="0" name="service.product" value="Exchange Server"/>
|
|
225
|
+
<param pos="2" name="service.version"/>
|
|
226
|
+
<param pos="1" name="host.name"/>
|
|
227
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
228
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
229
|
+
<param pos="0" name="os.device" value="General"/>
|
|
230
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
231
|
+
</fingerprint>
|
|
232
|
+
<fingerprint pattern="^([^ ]+) Microsoft Exchange Internet Mail Service (\d+\.\d+\.\d+\.\d+) ready *$">
|
|
233
|
+
<description>
|
|
258
234
|
Microsoft Exchange Server 5.0
|
|
259
235
|
(for sure, can't be confused with the IIS builtin SMTP service)
|
|
260
236
|
</description>
|
|
261
|
-
|
|
262
|
-
|
|
263
|
-
|
|
264
|
-
|
|
265
|
-
|
|
266
|
-
|
|
267
|
-
|
|
268
|
-
|
|
269
|
-
|
|
270
|
-
|
|
271
|
-
|
|
272
|
-
<
|
|
273
|
-
<description>
|
|
237
|
+
<param pos="0" name="service.vendor" value="Microsoft"/>
|
|
238
|
+
<param pos="0" name="service.family" value="Exchange Server"/>
|
|
239
|
+
<param pos="0" name="service.product" value="Exchange Server"/>
|
|
240
|
+
<param pos="2" name="service.version"/>
|
|
241
|
+
<param pos="1" name="host.name"/>
|
|
242
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
243
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
244
|
+
<param pos="0" name="os.device" value="General"/>
|
|
245
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
246
|
+
</fingerprint>
|
|
247
|
+
<fingerprint pattern="^([^ ]+) Microsoft ESMTP MAIL Service ready at .*$">
|
|
248
|
+
<description>
|
|
274
249
|
Microsoft Exchange 2007/2010
|
|
275
250
|
(for sure, can't be confused with the IIS builtin SMTP service)
|
|
276
251
|
</description>
|
|
277
|
-
|
|
278
|
-
|
|
279
|
-
|
|
280
|
-
|
|
281
|
-
|
|
282
|
-
|
|
283
|
-
|
|
284
|
-
|
|
285
|
-
|
|
286
|
-
|
|
287
|
-
|
|
288
|
-
|
|
289
|
-
<!-- smtp.foo.bar Microsoft SMTP MAIL ready at Tue, 6 Feb 2001 18:28:07 +0100 Version: 5.5.1877.197.19 -->
|
|
290
|
-
<description>
|
|
252
|
+
<example>foo Microsoft ESMTP MAIL Service ready at Wed, 21 Jul 2010 19:04:24 -0700</example>
|
|
253
|
+
<param pos="0" name="service.vendor" value="Microsoft"/>
|
|
254
|
+
<param pos="0" name="service.family" value="Exchange Server"/>
|
|
255
|
+
<param pos="0" name="service.product" value="Exchange Server"/>
|
|
256
|
+
<param pos="1" name="host.name"/>
|
|
257
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
258
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
259
|
+
<param pos="0" name="os.device" value="General"/>
|
|
260
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
261
|
+
</fingerprint>
|
|
262
|
+
<fingerprint pattern="^([^ ]+) Microsoft SMTP MAIL ready at (.+) Version: +(\d+\.\d+\.\d+\.\d+\.\d+) *$">
|
|
263
|
+
<description>
|
|
291
264
|
Microsoft IIS builtin SMTP service, or Microsoft Exchange Server
|
|
292
265
|
(they are differentiated from each other in smtp-iis.clp)
|
|
293
266
|
</description>
|
|
294
|
-
|
|
295
|
-
|
|
296
|
-
|
|
297
|
-
|
|
298
|
-
|
|
299
|
-
|
|
300
|
-
|
|
301
|
-
|
|
302
|
-
|
|
303
|
-
|
|
304
|
-
|
|
305
|
-
|
|
306
|
-
|
|
307
|
-
|
|
308
|
-
<!-- foo.bar.com Microsoft ESMTP MAIL Service, Version: 5.0.2195.1600 ready at Wed, 31 Jan 2001 00:10:50 -0400 -->
|
|
309
|
-
<description>
|
|
267
|
+
<param pos="0" name="service.vendor" value="Microsoft"/>
|
|
268
|
+
<param pos="0" name="service.family" value="IIS"/>
|
|
269
|
+
<param pos="0" name="service.product" value="IIS"/>
|
|
270
|
+
<param pos="3" name="service.version"/>
|
|
271
|
+
<param pos="1" name="host.name"/>
|
|
272
|
+
<param pos="2" name="system.time"/>
|
|
273
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
274
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
275
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
276
|
+
<param pos="0" name="os.device" value="General"/>
|
|
277
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
278
|
+
</fingerprint>
|
|
279
|
+
<fingerprint pattern="^([^ ]+) +Microsoft ESMTP MAIL Service, Version: +(\d+\.\d+\.\d+\.\d+) +ready at +(.+)$">
|
|
280
|
+
<description>
|
|
310
281
|
Microsoft IIS builtin SMTP service, or Microsoft Exchange Server
|
|
311
282
|
(they are differentiated from each other in smtp-iis.clp)
|
|
312
283
|
</description>
|
|
313
|
-
|
|
314
|
-
|
|
315
|
-
|
|
316
|
-
|
|
317
|
-
|
|
318
|
-
|
|
319
|
-
|
|
320
|
-
|
|
321
|
-
|
|
322
|
-
|
|
323
|
-
|
|
324
|
-
|
|
325
|
-
|
|
326
|
-
|
|
327
|
-
<fingerprint pattern="^([^ ]+) ESMTP Exim ([^ ]+\.[^ ]+) (.+)$">
|
|
328
|
-
<description>
|
|
284
|
+
<param pos="0" name="service.vendor" value="Microsoft"/>
|
|
285
|
+
<param pos="0" name="service.family" value="IIS"/>
|
|
286
|
+
<param pos="0" name="service.product" value="IIS"/>
|
|
287
|
+
<param pos="2" name="service.version"/>
|
|
288
|
+
<param pos="1" name="host.name"/>
|
|
289
|
+
<param pos="3" name="system.time"/>
|
|
290
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
291
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
292
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
293
|
+
<param pos="0" name="os.device" value="General"/>
|
|
294
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
295
|
+
</fingerprint>
|
|
296
|
+
<fingerprint pattern="^([^ ]+) ESMTP Exim ([^ ]+\.[^ ]+) (.+)$">
|
|
297
|
+
<description>
|
|
329
298
|
Exim (3 version numbers)
|
|
330
299
|
example: 220 foo.bar.com ESMTP Exim 3.12 #1 Wed, 31 Jan 2001 15:47:23 +1100
|
|
331
300
|
example: 220 foo.bar.com ESMTP Exim 3.22 1 Mon, 30 Jul 2001 23:16:12 +0100 [NO UCE, NO SPAM]
|
|
332
301
|
</description>
|
|
333
|
-
|
|
334
|
-
|
|
335
|
-
|
|
336
|
-
|
|
337
|
-
|
|
338
|
-
|
|
339
|
-
|
|
340
|
-
|
|
341
|
-
|
|
342
|
-
|
|
343
|
-
<description>
|
|
302
|
+
<param pos="0" name="service.vendor" value="exim"/>
|
|
303
|
+
<param pos="0" name="service.family" value="exim"/>
|
|
304
|
+
<param pos="0" name="service.product" value="exim"/>
|
|
305
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
306
|
+
<param pos="1" name="host.name"/>
|
|
307
|
+
<param pos="2" name="service.version"/>
|
|
308
|
+
<param pos="3" name="system.time"/>
|
|
309
|
+
</fingerprint>
|
|
310
|
+
<fingerprint pattern="^([^ ]+) FTGate server ready .*$">
|
|
311
|
+
<description>
|
|
344
312
|
FTGate mail server, runs on Windows 9x/NT/2k
|
|
345
313
|
http://www.ftgate.com
|
|
346
314
|
Example: 220 stoddardhoney.com FTGate server ready -attitude [C.o.r.E]
|
|
347
315
|
</description>
|
|
348
|
-
|
|
349
|
-
|
|
350
|
-
|
|
351
|
-
|
|
352
|
-
|
|
353
|
-
|
|
354
|
-
|
|
355
|
-
<description>
|
|
316
|
+
<param pos="0" name="service.vendor" value="Floosietek"/>
|
|
317
|
+
<param pos="0" name="service.family" value="FTGate"/>
|
|
318
|
+
<param pos="0" name="service.product" value="FTGate"/>
|
|
319
|
+
<param pos="1" name="host.name"/>
|
|
320
|
+
</fingerprint>
|
|
321
|
+
<fingerprint pattern="^(?:[^ ]+) +SMTP/smap Ready\.$">
|
|
322
|
+
<description>
|
|
356
323
|
TIS FWTK and derivatives
|
|
357
324
|
http://www.tis.com/research/software/
|
|
358
325
|
This fingerprint may be ambiguous because other firewalls (like
|
|
359
326
|
Gauntlet) are derived from TIS
|
|
360
327
|
</description>
|
|
361
|
-
|
|
362
|
-
|
|
363
|
-
|
|
364
|
-
|
|
365
|
-
|
|
366
|
-
|
|
367
|
-
<description>
|
|
328
|
+
<param pos="0" name="service.vendor" value="TIS"/>
|
|
329
|
+
<param pos="0" name="service.family" value="FWTK"/>
|
|
330
|
+
<param pos="0" name="service.product" value="FWTK"/>
|
|
331
|
+
</fingerprint>
|
|
332
|
+
<fingerprint pattern="^([^ ]+) GroupWise Internet Agent ([^ ]+\.[^ ]+\.[^ ]+) Ready \(C\).* Novell, Inc\. *$">
|
|
333
|
+
<description>
|
|
368
334
|
Novell GroupWise Internet Agent versions 5 and higher, 3 version numbers
|
|
369
335
|
example: 220 coleharbourplace.com GroupWise Internet Agent 5.5.1 Ready (C)1993, 1998 Novell, Inc.
|
|
370
336
|
</description>
|
|
371
|
-
|
|
372
|
-
|
|
373
|
-
|
|
374
|
-
|
|
375
|
-
|
|
376
|
-
|
|
377
|
-
|
|
378
|
-
|
|
379
|
-
<description>
|
|
337
|
+
<param pos="0" name="service.vendor" value="Novell"/>
|
|
338
|
+
<param pos="0" name="service.family" value="GroupWise"/>
|
|
339
|
+
<param pos="0" name="service.product" value="GroupWise"/>
|
|
340
|
+
<param pos="1" name="host.name"/>
|
|
341
|
+
<param pos="2" name="service.version"/>
|
|
342
|
+
</fingerprint>
|
|
343
|
+
<fingerprint pattern="^([^ ]+) GroupWise Internet Agent ([^ ]+\.[^ ]+) Ready \(C\).* Novell, Inc\. *$">
|
|
344
|
+
<description>
|
|
380
345
|
Novell GroupWise Internet Agent versions 5 and higher, 2 version numbers
|
|
381
346
|
</description>
|
|
382
|
-
|
|
383
|
-
|
|
384
|
-
|
|
385
|
-
|
|
386
|
-
|
|
387
|
-
|
|
388
|
-
|
|
389
|
-
|
|
390
|
-
<description>
|
|
347
|
+
<param pos="0" name="service.vendor" value="Novell"/>
|
|
348
|
+
<param pos="0" name="service.family" value="GroupWise"/>
|
|
349
|
+
<param pos="0" name="service.product" value="GroupWise"/>
|
|
350
|
+
<param pos="1" name="host.name"/>
|
|
351
|
+
<param pos="2" name="service.version"/>
|
|
352
|
+
</fingerprint>
|
|
353
|
+
<fingerprint pattern="^([^ ]+) GroupWise SMTP/MIME Daemon ([^ ]+\.[^ ]+) v([^ ]+) Ready \(C\).* Novell, Inc\. *$">
|
|
354
|
+
<description>
|
|
391
355
|
Novell GroupWise versions below 5
|
|
392
356
|
example: 220 bates.at GroupWise SMTP/MIME Daemon 4.1 v3 Ready (C)1993, 1996 Novell, Inc.
|
|
393
357
|
</description>
|
|
394
|
-
|
|
395
|
-
|
|
396
|
-
|
|
397
|
-
|
|
398
|
-
|
|
399
|
-
|
|
400
|
-
|
|
401
|
-
|
|
402
|
-
|
|
403
|
-
<description>
|
|
358
|
+
<param pos="0" name="service.vendor" value="Novell"/>
|
|
359
|
+
<param pos="0" name="service.family" value="GroupWise"/>
|
|
360
|
+
<param pos="0" name="service.product" value="GroupWise"/>
|
|
361
|
+
<param pos="1" name="host.name"/>
|
|
362
|
+
<param pos="2" name="service.version"/>
|
|
363
|
+
<param pos="3" name="service.version.version"/>
|
|
364
|
+
</fingerprint>
|
|
365
|
+
<fingerprint pattern="^([^ ]+) running IBM VM SMTP (.+) on (.+) *$">
|
|
366
|
+
<description>
|
|
404
367
|
IBM SMTP server for VM/ESA on IBM S/390 and IBM eserver z/Series 900.
|
|
405
368
|
http://www.vm.ibm.com
|
|
406
369
|
http://www-1.ibm.com/servers/eserver/zseries/
|
|
@@ -408,320 +371,300 @@ The system or service fingerprint with the highest certainty overwrites the othe
|
|
|
408
371
|
example: 220 mail.foo.bar running IBM VM SMTP Level 3A0 on Mon, 10 Sep 2001 07:21:54 EDT
|
|
409
372
|
example: 220 mail.foo.bar running IBM VM SMTP V2R4 on Mon, 10 Sep 2001 12:23:47 +0100
|
|
410
373
|
</description>
|
|
411
|
-
|
|
412
|
-
|
|
413
|
-
|
|
414
|
-
|
|
415
|
-
|
|
416
|
-
|
|
417
|
-
|
|
418
|
-
|
|
419
|
-
|
|
420
|
-
|
|
421
|
-
<description>
|
|
374
|
+
<param pos="0" name="service.vendor" value="IBM"/>
|
|
375
|
+
<param pos="0" name="service.family" value="VM"/>
|
|
376
|
+
<param pos="0" name="service.product" value="VM"/>
|
|
377
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
378
|
+
<param pos="1" name="host.name"/>
|
|
379
|
+
<param pos="2" name="service.version"/>
|
|
380
|
+
<param pos="3" name="system.time"/>
|
|
381
|
+
</fingerprint>
|
|
382
|
+
<fingerprint pattern="^([^ ]+) running IBM VM SMTP (.+); (.+) *$">
|
|
383
|
+
<description>
|
|
422
384
|
IBM SMTP server for VM/ESA on IBM S/390 and IBM eserver z/Series 900.
|
|
423
385
|
http://www.vm.ibm.com
|
|
424
386
|
http://www-1.ibm.com/servers/eserver/zseries/
|
|
425
387
|
http://mitvma.mit.edu/system/vm.html
|
|
426
388
|
example: 220 mail.foo.bar ESMTP running IBM VM SMTP V2R4; Mon, 10 Sep 2001 07:24:35 -0400 (EDT)
|
|
427
389
|
</description>
|
|
428
|
-
|
|
429
|
-
|
|
430
|
-
|
|
431
|
-
|
|
432
|
-
|
|
433
|
-
|
|
434
|
-
|
|
435
|
-
|
|
436
|
-
|
|
437
|
-
|
|
438
|
-
<description>
|
|
390
|
+
<param pos="0" name="service.vendor" value="IBM"/>
|
|
391
|
+
<param pos="0" name="service.family" value="VM"/>
|
|
392
|
+
<param pos="0" name="service.product" value="VM"/>
|
|
393
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
394
|
+
<param pos="1" name="host.name"/>
|
|
395
|
+
<param pos="2" name="service.version"/>
|
|
396
|
+
<param pos="3" name="system.time"/>
|
|
397
|
+
</fingerprint>
|
|
398
|
+
<fingerprint pattern="^([^ ]+) \(IntraStore TurboSendmail\) ESMTP Service ready *$">
|
|
399
|
+
<description>
|
|
439
400
|
Syntegra/CDC IntraStore TurboSendmail, part of the IntraStore server which runs on
|
|
440
401
|
the following platforms ONLY: Linux, HP-UX, Solaris, AIX, and Windows NT/2000
|
|
441
402
|
see http://www.cdc.com for more information
|
|
442
403
|
</description>
|
|
443
|
-
|
|
444
|
-
|
|
445
|
-
|
|
446
|
-
|
|
447
|
-
|
|
448
|
-
|
|
449
|
-
|
|
450
|
-
<
|
|
451
|
-
|
|
452
|
-
|
|
453
|
-
|
|
454
|
-
|
|
455
|
-
|
|
456
|
-
|
|
457
|
-
|
|
458
|
-
|
|
459
|
-
|
|
460
|
-
|
|
461
|
-
<fingerprint pattern="^([^ ]+) \(Mail-Max Version (\d+\.\d+\.\d+\.\d+), (.+, .+)\) ESMTP Mail Server Ready. *$">
|
|
462
|
-
<description>
|
|
404
|
+
<example host.name="192.168.1.1">192.168.1.1 (IntraStore TurboSendmail) ESMTP Service ready</example>
|
|
405
|
+
<param pos="0" name="service.vendor" value="BT"/>
|
|
406
|
+
<param pos="0" name="service.family" value="IntraStore"/>
|
|
407
|
+
<param pos="0" name="service.product" value="IntraStore"/>
|
|
408
|
+
<param pos="1" name="host.name"/>
|
|
409
|
+
</fingerprint>
|
|
410
|
+
<fingerprint pattern="^(\S+) E?SMTP Server \(JAMES E?SMTP Server ([\d\.]+)\) ready (\S{3}, \d{2} \S{3} \d{4} \d{2}:\d{2}:\d{2} \S+) \(\S+\)$">
|
|
411
|
+
<description>JAMES SMTP Server</description>
|
|
412
|
+
<example host.name="example.com" service.version="2.3.2">example.com SMTP Server (JAMES SMTP Server 2.3.2) ready Tue, 19 May 2015 00:36:13 +0200 (CEST)</example>
|
|
413
|
+
<param pos="0" name="service.vendor" value="Apache"/>
|
|
414
|
+
<param pos="0" name="service.product" value="James"/>
|
|
415
|
+
<param pos="2" name="service.version"/>
|
|
416
|
+
<param pos="1" name="host.name"/>
|
|
417
|
+
<param pos="3" name="system.time"/>
|
|
418
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
419
|
+
</fingerprint>
|
|
420
|
+
<fingerprint pattern="^([^ ]+) \(Mail-Max Version (\d+\.\d+\.\d+\.\d+), (.+, .+)\) ESMTP Mail Server Ready. *$">
|
|
421
|
+
<description>
|
|
463
422
|
Mail Max (4 version numbers)
|
|
464
423
|
example: 220 MAIL3 (Mail-Max Version 4.2.4.7, Wed, 31 Jan 2001 03:44:35 +0100 WST) ESMTP Mail Server Ready.
|
|
465
424
|
</description>
|
|
466
|
-
|
|
467
|
-
|
|
468
|
-
|
|
469
|
-
|
|
470
|
-
|
|
471
|
-
|
|
472
|
-
|
|
473
|
-
|
|
474
|
-
|
|
475
|
-
<
|
|
476
|
-
|
|
477
|
-
|
|
478
|
-
|
|
479
|
-
|
|
480
|
-
|
|
481
|
-
|
|
482
|
-
|
|
483
|
-
|
|
484
|
-
|
|
485
|
-
|
|
486
|
-
|
|
487
|
-
<fingerprint pattern="^([^ ]+) \(Mail-Max Version (\d+\.\d+), (.+, .+)\) ESMTP Mail Server Ready. *$">
|
|
488
|
-
<description>
|
|
425
|
+
<param pos="0" name="service.vendor" value="Mail-Max"/>
|
|
426
|
+
<param pos="0" name="service.family" value="Mail-Max"/>
|
|
427
|
+
<param pos="0" name="service.product" value="Mail-Max"/>
|
|
428
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
429
|
+
<param pos="1" name="host.name"/>
|
|
430
|
+
<param pos="2" name="service.version"/>
|
|
431
|
+
<param pos="3" name="system.time"/>
|
|
432
|
+
</fingerprint>
|
|
433
|
+
<fingerprint pattern="^(\S+) E?SMTP MailEnable Service, Version: ([\d\.]+)-- ready at (\d{2}/\d{2}/\d{2} \d{2}:\d{2}:\d{2})$">
|
|
434
|
+
<description>Simple MailEnable</description>
|
|
435
|
+
<example host.name="example.com">example.com ESMTP MailEnable Service, Version: 1.8-- ready at 05/20/15 08:50:22</example>
|
|
436
|
+
<param pos="0" name="service.vendor" value="MailEnable"/>
|
|
437
|
+
<param pos="0" name="service.family" value="MailEnable"/>
|
|
438
|
+
<param pos="0" name="service.product" value="MailEnable"/>
|
|
439
|
+
<param pos="0" name="system.time.format" value="MM/dd/yy HH:mm:ss"/>
|
|
440
|
+
<param pos="1" name="host.name"/>
|
|
441
|
+
<param pos="2" name="service.version"/>
|
|
442
|
+
<param pos="3" name="system.time"/>
|
|
443
|
+
</fingerprint>
|
|
444
|
+
<fingerprint pattern="^([^ ]+) \(Mail-Max Version (\d+\.\d+), (.+, .+)\) ESMTP Mail Server Ready. *$">
|
|
445
|
+
<description>
|
|
489
446
|
Mail Max (2 version numbers)
|
|
490
447
|
example: 220 WEBB (Mail-Max Version 3.065, Wed, 31 Jan 2001 03:46:11 +0100 WST) ESMTP Mail Server Ready.
|
|
491
448
|
</description>
|
|
492
|
-
|
|
493
|
-
|
|
494
|
-
|
|
495
|
-
|
|
496
|
-
|
|
497
|
-
|
|
498
|
-
|
|
499
|
-
|
|
500
|
-
|
|
501
|
-
|
|
502
|
-
<description>
|
|
449
|
+
<param pos="0" name="service.vendor" value="Mail-Max"/>
|
|
450
|
+
<param pos="0" name="service.family" value="Mail-Max"/>
|
|
451
|
+
<param pos="0" name="service.product" value="Mail-Max"/>
|
|
452
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
453
|
+
<param pos="1" name="host.name"/>
|
|
454
|
+
<param pos="2" name="service.version"/>
|
|
455
|
+
<param pos="3" name="system.time"/>
|
|
456
|
+
</fingerprint>
|
|
457
|
+
<fingerprint pattern="^([^ ]+) +MailSite ESMTP Receiver Version ([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+) Ready *$">
|
|
458
|
+
<description>
|
|
503
459
|
Rockliffe MailSite http://www.rockliffe.com
|
|
504
460
|
example: 220 bas.com.ar MailSite ESMTP Receiver Version 3.4.6.0 Ready
|
|
505
461
|
</description>
|
|
506
|
-
|
|
507
|
-
|
|
508
|
-
|
|
509
|
-
|
|
510
|
-
|
|
511
|
-
|
|
512
|
-
|
|
513
|
-
|
|
514
|
-
<description>
|
|
462
|
+
<param pos="0" name="service.vendor" value="Rockliffe"/>
|
|
463
|
+
<param pos="0" name="service.family" value="MailSite"/>
|
|
464
|
+
<param pos="0" name="service.product" value="MailSite"/>
|
|
465
|
+
<param pos="1" name="host.name"/>
|
|
466
|
+
<param pos="2" name="service.version"/>
|
|
467
|
+
</fingerprint>
|
|
468
|
+
<fingerprint pattern="^([^ ]+) +MailSite ESMTP Receiver Version ([^ ]+\.[^ ]+\.[^ ]+) Ready *$">
|
|
469
|
+
<description>
|
|
515
470
|
Rockliffe MailSite http://www.rockliffe.com
|
|
516
471
|
example: 220 rhino.accessweb.com MailSite SMTP Receiver Version 2.1.7 Ready
|
|
517
472
|
</description>
|
|
518
|
-
|
|
519
|
-
|
|
520
|
-
|
|
521
|
-
|
|
522
|
-
|
|
523
|
-
|
|
524
|
-
|
|
525
|
-
|
|
526
|
-
<description>
|
|
473
|
+
<param pos="0" name="service.vendor" value="Rockliffe"/>
|
|
474
|
+
<param pos="0" name="service.family" value="MailSite"/>
|
|
475
|
+
<param pos="0" name="service.product" value="MailSite"/>
|
|
476
|
+
<param pos="1" name="host.name"/>
|
|
477
|
+
<param pos="2" name="service.version"/>
|
|
478
|
+
</fingerprint>
|
|
479
|
+
<fingerprint pattern="^([^ ]+) +MAILsweeper ESMTP Receiver Version ([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+) Ready *$">
|
|
480
|
+
<description>
|
|
527
481
|
Content Security MAILsweeper for SMTP http://www.contenttechnologies.com/products/msw4smtp/default.asp
|
|
528
482
|
example: 220 infotech.at MAILsweeper ESMTP Receiver Version 4.2.1.0 Ready
|
|
529
483
|
</description>
|
|
530
|
-
|
|
531
|
-
|
|
532
|
-
|
|
533
|
-
|
|
534
|
-
|
|
535
|
-
|
|
536
|
-
|
|
537
|
-
|
|
538
|
-
<description>
|
|
484
|
+
<param pos="0" name="service.vendor" value="Clearswift"/>
|
|
485
|
+
<param pos="0" name="service.family" value="MAILsweeper"/>
|
|
486
|
+
<param pos="0" name="service.product" value="MAILsweeper"/>
|
|
487
|
+
<param pos="1" name="host.name"/>
|
|
488
|
+
<param pos="2" name="service.version"/>
|
|
489
|
+
</fingerprint>
|
|
490
|
+
<fingerprint pattern="^([^ ]+) +ESMTP MDaemon ([^ ]+\.[^ ]+\.[^ ]+) UNREGISTERED; *(.+) *$">
|
|
491
|
+
<description>
|
|
539
492
|
MDaemon mail server
|
|
540
493
|
220 foo.bar ESMTP MDaemon 4.0.5 UNREGISTERED; Sat, 06 Oct 2001 09:10:56 +0400
|
|
541
494
|
</description>
|
|
542
|
-
|
|
543
|
-
|
|
544
|
-
|
|
545
|
-
|
|
546
|
-
|
|
547
|
-
|
|
548
|
-
|
|
549
|
-
|
|
550
|
-
|
|
551
|
-
|
|
552
|
-
|
|
553
|
-
|
|
554
|
-
|
|
555
|
-
|
|
556
|
-
|
|
557
|
-
|
|
558
|
-
<description>
|
|
495
|
+
<param pos="0" name="service.vendor" value="Alt-N"/>
|
|
496
|
+
<param pos="0" name="service.family" value="MDaemon"/>
|
|
497
|
+
<param pos="0" name="service.product" value="MDaemon"/>
|
|
498
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
499
|
+
<param pos="0" name="mdaemon.unregistered" value="yes"/>
|
|
500
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
501
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
502
|
+
<param pos="0" name="os.device" value="General"/>
|
|
503
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
504
|
+
<param pos="0" name="os.arch" value="x86"/>
|
|
505
|
+
<param pos="1" name="host.name"/>
|
|
506
|
+
<param pos="2" name="service.version"/>
|
|
507
|
+
<param pos="3" name="system.time"/>
|
|
508
|
+
</fingerprint>
|
|
509
|
+
<fingerprint pattern="^([^ ]+) +ESMTP MDaemon ([^ ]+\.[^ ]+\.[^ ]+); *(.+) *$">
|
|
510
|
+
<description>
|
|
559
511
|
MDaemon mail server
|
|
560
512
|
220 foo.bar ESMTP MDaemon 4.0.2; Sat, 06 Oct 2001 01:46:44 -0500
|
|
561
513
|
</description>
|
|
562
|
-
|
|
563
|
-
|
|
564
|
-
|
|
565
|
-
|
|
566
|
-
|
|
567
|
-
|
|
568
|
-
|
|
569
|
-
|
|
570
|
-
|
|
571
|
-
|
|
572
|
-
|
|
573
|
-
|
|
574
|
-
|
|
575
|
-
|
|
576
|
-
|
|
577
|
-
<description>
|
|
514
|
+
<param pos="0" name="service.vendor" value="Alt-N"/>
|
|
515
|
+
<param pos="0" name="service.family" value="MDaemon"/>
|
|
516
|
+
<param pos="0" name="service.product" value="MDaemon"/>
|
|
517
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
518
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
519
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
520
|
+
<param pos="0" name="os.device" value="General"/>
|
|
521
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
522
|
+
<param pos="0" name="os.arch" value="x86"/>
|
|
523
|
+
<param pos="1" name="host.name"/>
|
|
524
|
+
<param pos="2" name="service.version"/>
|
|
525
|
+
<param pos="3" name="system.time"/>
|
|
526
|
+
</fingerprint>
|
|
527
|
+
<fingerprint pattern="^([^ ]+) +ESMTP MDaemon ([^ ]+\.[^ ]+\.[^ ]+) ready *$">
|
|
528
|
+
<description>
|
|
578
529
|
MDaemon mail server
|
|
579
530
|
220 foo.bar ESMTP MDaemon 3.5.7 ready
|
|
580
531
|
</description>
|
|
581
|
-
|
|
582
|
-
|
|
583
|
-
|
|
584
|
-
|
|
585
|
-
|
|
586
|
-
|
|
587
|
-
|
|
588
|
-
|
|
589
|
-
|
|
590
|
-
|
|
591
|
-
|
|
592
|
-
|
|
593
|
-
|
|
594
|
-
<description>
|
|
532
|
+
<param pos="0" name="service.vendor" value="Alt-N"/>
|
|
533
|
+
<param pos="0" name="service.family" value="MDaemon"/>
|
|
534
|
+
<param pos="0" name="service.product" value="MDaemon"/>
|
|
535
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
536
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
537
|
+
<param pos="0" name="os.device" value="General"/>
|
|
538
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
539
|
+
<param pos="0" name="os.arch" value="x86"/>
|
|
540
|
+
<param pos="1" name="host.name"/>
|
|
541
|
+
<param pos="2" name="service.version"/>
|
|
542
|
+
</fingerprint>
|
|
543
|
+
<fingerprint pattern="^([^ ]+) +ESMTP service ready \[[0-9]+\] MDaemon v([^ ]+\.[^ ]+) ([^ ]+) *$">
|
|
544
|
+
<description>
|
|
595
545
|
MDaemon mail server
|
|
596
546
|
220 foo.bar.com ESMTP service ready [1] MDaemon v2.84 R
|
|
597
547
|
</description>
|
|
598
|
-
|
|
599
|
-
|
|
600
|
-
|
|
601
|
-
|
|
602
|
-
|
|
603
|
-
|
|
604
|
-
|
|
605
|
-
|
|
606
|
-
|
|
607
|
-
|
|
608
|
-
|
|
609
|
-
|
|
610
|
-
|
|
611
|
-
|
|
612
|
-
<description>
|
|
548
|
+
<param pos="0" name="service.vendor" value="Alt-N"/>
|
|
549
|
+
<param pos="0" name="service.family" value="MDaemon"/>
|
|
550
|
+
<param pos="0" name="service.product" value="MDaemon"/>
|
|
551
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
552
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
553
|
+
<param pos="0" name="os.device" value="General"/>
|
|
554
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
555
|
+
<param pos="0" name="os.arch" value="x86"/>
|
|
556
|
+
<param pos="1" name="host.name"/>
|
|
557
|
+
<param pos="2" name="service.version"/>
|
|
558
|
+
<param pos="3" name="service.version.version"/>
|
|
559
|
+
</fingerprint>
|
|
560
|
+
<fingerprint pattern="^([^ ]+) +ESMTP service ready \[[0-9]+\] using MDaemon v([^ ]+\.[^ ]+\.[^ ]+) ([^ ]+) *$">
|
|
561
|
+
<description>
|
|
613
562
|
MDaemon mail server
|
|
614
563
|
220 foo.bar.com ESMTP service ready [1] using MDaemon v3.0.3 R
|
|
615
564
|
</description>
|
|
616
|
-
|
|
617
|
-
|
|
618
|
-
|
|
619
|
-
|
|
620
|
-
|
|
621
|
-
|
|
622
|
-
|
|
623
|
-
|
|
624
|
-
|
|
625
|
-
|
|
626
|
-
|
|
627
|
-
|
|
628
|
-
|
|
629
|
-
|
|
630
|
-
<description>
|
|
565
|
+
<param pos="0" name="service.vendor" value="Alt-N"/>
|
|
566
|
+
<param pos="0" name="service.family" value="MDaemon"/>
|
|
567
|
+
<param pos="0" name="service.product" value="MDaemon"/>
|
|
568
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
569
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
570
|
+
<param pos="0" name="os.device" value="General"/>
|
|
571
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
572
|
+
<param pos="0" name="os.arch" value="x86"/>
|
|
573
|
+
<param pos="1" name="host.name"/>
|
|
574
|
+
<param pos="2" name="service.version"/>
|
|
575
|
+
<param pos="3" name="service.version.version"/>
|
|
576
|
+
</fingerprint>
|
|
577
|
+
<fingerprint pattern="^([^ ]+) +ESMTP service ready \[[0-9]+\] MDaemon v([^ ]+\.[^ ]+) ([^ ]+) ([^ ]+) *$">
|
|
578
|
+
<description>
|
|
631
579
|
MDaemon mail server
|
|
632
580
|
220 foo.bar.com ESMTP service ready [1] MDaemon v2.7 SP5 R
|
|
633
581
|
</description>
|
|
634
|
-
|
|
635
|
-
|
|
636
|
-
|
|
637
|
-
|
|
638
|
-
|
|
639
|
-
|
|
640
|
-
|
|
641
|
-
|
|
642
|
-
|
|
643
|
-
|
|
644
|
-
|
|
645
|
-
|
|
646
|
-
|
|
647
|
-
|
|
648
|
-
|
|
649
|
-
<description>
|
|
582
|
+
<param pos="0" name="service.vendor" value="Alt-N"/>
|
|
583
|
+
<param pos="0" name="service.family" value="MDaemon"/>
|
|
584
|
+
<param pos="0" name="service.product" value="MDaemon"/>
|
|
585
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
586
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
587
|
+
<param pos="0" name="os.device" value="General"/>
|
|
588
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
589
|
+
<param pos="0" name="os.arch" value="x86"/>
|
|
590
|
+
<param pos="1" name="host.name"/>
|
|
591
|
+
<param pos="2" name="service.version"/>
|
|
592
|
+
<param pos="3" name="service.version.version"/>
|
|
593
|
+
<param pos="4" name="service.version.version.version"/>
|
|
594
|
+
</fingerprint>
|
|
595
|
+
<fingerprint pattern="^([^ ]+) +ESMTP service ready \[[0-9]+\] MDaemon v([^ ]+)\.([^ ]+)\.([^ ]+)\.([^ ]+) ([^ ]+) *$">
|
|
596
|
+
<description>
|
|
650
597
|
MDaemon mail server
|
|
651
598
|
220 foo.bar.com ESMTP service ready [1] MDaemon v2.8.7.0 R
|
|
652
599
|
</description>
|
|
653
|
-
|
|
654
|
-
|
|
655
|
-
|
|
656
|
-
|
|
657
|
-
|
|
658
|
-
|
|
659
|
-
|
|
660
|
-
|
|
661
|
-
|
|
662
|
-
|
|
663
|
-
|
|
664
|
-
|
|
665
|
-
|
|
666
|
-
|
|
667
|
-
|
|
668
|
-
|
|
669
|
-
|
|
670
|
-
<description>
|
|
600
|
+
<param pos="0" name="service.vendor" value="Alt-N"/>
|
|
601
|
+
<param pos="0" name="service.family" value="MDaemon"/>
|
|
602
|
+
<param pos="0" name="service.product" value="MDaemon"/>
|
|
603
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
604
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
605
|
+
<param pos="0" name="os.device" value="General"/>
|
|
606
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
607
|
+
<param pos="0" name="os.arch" value="x86"/>
|
|
608
|
+
<param pos="1" name="host.name"/>
|
|
609
|
+
<param pos="2" name="service.version"/>
|
|
610
|
+
<param pos="3" name="service.version.version"/>
|
|
611
|
+
<param pos="4" name="service.version.version.version"/>
|
|
612
|
+
<param pos="5" name="service.version.version.version.version"/>
|
|
613
|
+
<param pos="6" name="service.version.version.version.version.version"/>
|
|
614
|
+
</fingerprint>
|
|
615
|
+
<fingerprint pattern="^([^ ]+) +ESMTP service ready \[[0-9]+\] \(MDaemon v([^ ]+\.[^ ]+) ([^ ]+) ([^ ]+)\) *$">
|
|
616
|
+
<description>
|
|
671
617
|
MDaemon mail server
|
|
672
618
|
220 foo.bar.com ESMTP service ready [2] (MDaemon v2.7 SP4 R)
|
|
673
619
|
</description>
|
|
674
|
-
|
|
675
|
-
|
|
676
|
-
|
|
677
|
-
|
|
678
|
-
|
|
679
|
-
|
|
680
|
-
|
|
681
|
-
|
|
682
|
-
|
|
683
|
-
|
|
684
|
-
|
|
685
|
-
|
|
686
|
-
|
|
687
|
-
|
|
688
|
-
|
|
689
|
-
<description>
|
|
620
|
+
<param pos="0" name="service.vendor" value="Alt-N"/>
|
|
621
|
+
<param pos="0" name="service.family" value="MDaemon"/>
|
|
622
|
+
<param pos="0" name="service.product" value="MDaemon"/>
|
|
623
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
624
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
625
|
+
<param pos="0" name="os.device" value="General"/>
|
|
626
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
627
|
+
<param pos="0" name="os.arch" value="x86"/>
|
|
628
|
+
<param pos="1" name="host.name"/>
|
|
629
|
+
<param pos="2" name="service.version"/>
|
|
630
|
+
<param pos="3" name="service.version.version"/>
|
|
631
|
+
<param pos="4" name="service.version.version.version"/>
|
|
632
|
+
</fingerprint>
|
|
633
|
+
<fingerprint pattern="^([^ ]+) +ESMTP service ready \[[0-9]+\] \(MDaemon v([^ ]+\.[^ ]+) ([^ ]+) ([^ ]+) ([^ ]+)\) *$">
|
|
634
|
+
<description>
|
|
690
635
|
MDaemon mail server
|
|
691
636
|
220 foo.bar.com ESMTP service ready [1] (MDaemon v2.5 rB b1 32-T)
|
|
692
637
|
</description>
|
|
693
|
-
|
|
694
|
-
|
|
695
|
-
|
|
696
|
-
|
|
697
|
-
|
|
698
|
-
|
|
699
|
-
|
|
700
|
-
|
|
701
|
-
|
|
702
|
-
|
|
703
|
-
|
|
704
|
-
|
|
705
|
-
|
|
706
|
-
|
|
707
|
-
|
|
708
|
-
|
|
709
|
-
|
|
710
|
-
<description>
|
|
638
|
+
<param pos="0" name="service.vendor" value="Alt-N"/>
|
|
639
|
+
<param pos="0" name="service.family" value="MDaemon"/>
|
|
640
|
+
<param pos="0" name="service.product" value="MDaemon"/>
|
|
641
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
642
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
643
|
+
<param pos="0" name="os.device" value="General"/>
|
|
644
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
645
|
+
<param pos="0" name="os.arch" value="x86"/>
|
|
646
|
+
<param pos="1" name="host.name"/>
|
|
647
|
+
<param pos="2" name="service.version"/>
|
|
648
|
+
<param pos="3" name="service.version.version"/>
|
|
649
|
+
<param pos="4" name="service.version.version.version"/>
|
|
650
|
+
<param pos="5" name="service.version.version.version.version"/>
|
|
651
|
+
</fingerprint>
|
|
652
|
+
<!-- example: 220 mail.db-list.com ESMTP MERAK 3.00.140; Tue, 24 Jul 2001 21:30:47 -0700 -->
|
|
653
|
+
<fingerprint pattern="^([^ ]+) +ESMTP MERAK ([^ ]+\.[^ ]+\.[^ ]+); *(.+) *$">
|
|
654
|
+
<description>
|
|
711
655
|
Merak mail server http://www.icewarp.com/merakmail/ (runs on 2000/NT/9x)
|
|
712
656
|
220 mail.db-list.com ESMTP MERAK 3.00.140; Tue, 24 Jul 2001 21:30:47 -0700
|
|
713
657
|
</description>
|
|
714
|
-
|
|
715
|
-
|
|
716
|
-
|
|
717
|
-
|
|
718
|
-
|
|
719
|
-
|
|
720
|
-
|
|
721
|
-
|
|
722
|
-
|
|
723
|
-
|
|
724
|
-
<description>
|
|
658
|
+
<param pos="0" name="service.vendor" value="Merak"/>
|
|
659
|
+
<param pos="0" name="service.family" value="Mail Server"/>
|
|
660
|
+
<param pos="0" name="service.product" value="Mail Server"/>
|
|
661
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
662
|
+
<param pos="1" name="host.name"/>
|
|
663
|
+
<param pos="2" name="service.version"/>
|
|
664
|
+
<param pos="3" name="system.time"/>
|
|
665
|
+
</fingerprint>
|
|
666
|
+
<fingerprint pattern="^MERCUR SMTP-Server \(v([^ ]+\.[^ ])0\.([^ ]+) ([^ ]+)\) for (.+) ready at (.+) *$">
|
|
667
|
+
<description>
|
|
725
668
|
Atrium's MERCUR SMTP server
|
|
726
669
|
http://www.atrium-software.com/pub/support_e.cfm
|
|
727
670
|
example: 220 MERCUR SMTP-Server (v3.20.01 KA-0098304) for Windows NT ready at Tue, 6 Feb 2001 21:38:26 +0100
|
|
@@ -739,203 +682,189 @@ The system or service fingerprint with the highest certainty overwrites the othe
|
|
|
739
682
|
example: 220 MERCUR SMTP-Server (v3.30.03 DG-0098304) for Windows NT ready at Tue, 6 Feb 2001 22:52:50 +0100
|
|
740
683
|
example: 220 MERCUR SMTP-Server (v3.20.01 SY-0098318) for Windows NT ready at Tue, 6 Feb 2001 23:26:22 +0100
|
|
741
684
|
</description>
|
|
742
|
-
|
|
743
|
-
|
|
744
|
-
|
|
745
|
-
|
|
746
|
-
|
|
747
|
-
|
|
748
|
-
|
|
749
|
-
|
|
750
|
-
|
|
751
|
-
|
|
752
|
-
|
|
753
|
-
|
|
754
|
-
<description>
|
|
685
|
+
<param pos="0" name="service.vendor" value="Atrium Software"/>
|
|
686
|
+
<param pos="0" name="service.family" value="MERCUR"/>
|
|
687
|
+
<param pos="0" name="service.product" value="MERCUR"/>
|
|
688
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
689
|
+
<param pos="1" name="service.version"/>
|
|
690
|
+
<param pos="2" name="service.version.version"/>
|
|
691
|
+
<param pos="3" name="service.version.version.version"/>
|
|
692
|
+
<param pos="4" name="mercur.os.info"/>
|
|
693
|
+
<param pos="5" name="system.time"/>
|
|
694
|
+
</fingerprint>
|
|
695
|
+
<fingerprint pattern="^([^ ]+) Mercury ([^ ]+\.[^ ]+) ESMTP server ready.$">
|
|
696
|
+
<description>
|
|
755
697
|
Mercury NLM for Netware
|
|
756
698
|
http://www.pmail.com/index.cfm
|
|
757
699
|
example: 220 mail.law.utexas.edu Mercury 1.43 ESMTP server ready.
|
|
758
700
|
</description>
|
|
759
|
-
|
|
760
|
-
|
|
761
|
-
|
|
762
|
-
|
|
763
|
-
|
|
764
|
-
|
|
765
|
-
|
|
766
|
-
|
|
767
|
-
|
|
768
|
-
|
|
769
|
-
|
|
770
|
-
<description>
|
|
701
|
+
<param pos="0" name="service.family" value="Mercury Mail Transport System"/>
|
|
702
|
+
<param pos="0" name="service.product" value="Mercury Mail Transport System"/>
|
|
703
|
+
<param pos="0" name="os.vendor" value="Novell"/>
|
|
704
|
+
<param pos="0" name="os.family" value="NetWare"/>
|
|
705
|
+
<param pos="0" name="os.device" value="General"/>
|
|
706
|
+
<param pos="0" name="os.product" value="NetWare"/>
|
|
707
|
+
<param pos="1" name="host.name"/>
|
|
708
|
+
<param pos="2" name="service.version"/>
|
|
709
|
+
</fingerprint>
|
|
710
|
+
<fingerprint pattern="^([^ ]+) Mercury/32 v([^ ]+\.[^ ]+) SMTP/ESMTP server ready.$">
|
|
711
|
+
<description>
|
|
771
712
|
Mercury/32 for Win9x/NT/2000
|
|
772
713
|
http://www.pmail.com/index.cfm
|
|
773
714
|
example: 220 jimmy.qmuc.ac.uk Mercury/32 v3.01a SMTP/ESMTP server ready.
|
|
774
715
|
</description>
|
|
775
|
-
|
|
776
|
-
|
|
777
|
-
|
|
778
|
-
|
|
779
|
-
|
|
780
|
-
|
|
781
|
-
|
|
782
|
-
|
|
783
|
-
|
|
784
|
-
|
|
785
|
-
|
|
786
|
-
<description>
|
|
716
|
+
<param pos="0" name="service.family" value="Mercury Mail Transport System"/>
|
|
717
|
+
<param pos="0" name="service.product" value="Mercury Mail Transport System"/>
|
|
718
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
719
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
720
|
+
<param pos="0" name="os.device" value="General"/>
|
|
721
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
722
|
+
<param pos="1" name="host.name"/>
|
|
723
|
+
<param pos="2" name="service.version"/>
|
|
724
|
+
</fingerprint>
|
|
725
|
+
<fingerprint pattern="^([^ ]+) Mercury/32 v([^ ]+\.[^ ]+) ESMTP server ready.$">
|
|
726
|
+
<description>
|
|
787
727
|
Mercury/32 for Win9x/NT/2000
|
|
788
728
|
http://www.pmail.com/index.cfm
|
|
789
729
|
example: 220 mail-gateway1.acfw.net Mercury/32 v3.30 ESMTP server ready.
|
|
790
730
|
</description>
|
|
791
|
-
|
|
792
|
-
|
|
793
|
-
|
|
794
|
-
|
|
795
|
-
|
|
796
|
-
|
|
797
|
-
|
|
798
|
-
|
|
799
|
-
|
|
800
|
-
|
|
801
|
-
|
|
802
|
-
<description>
|
|
731
|
+
<param pos="0" name="service.family" value="Mercury Mail Transport System"/>
|
|
732
|
+
<param pos="0" name="service.product" value="Mercury Mail Transport System"/>
|
|
733
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
734
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
735
|
+
<param pos="0" name="os.device" value="General"/>
|
|
736
|
+
<param pos="0" name="os.product" value="Windows"/>
|
|
737
|
+
<param pos="1" name="host.name"/>
|
|
738
|
+
<param pos="2" name="service.version"/>
|
|
739
|
+
</fingerprint>
|
|
740
|
+
<fingerprint pattern="^([^ ]+) SMTP NAVIEG ([^ ]+\.[^ ]+\.[^ ]+); (.+)* http.*$">
|
|
741
|
+
<description>
|
|
803
742
|
Norton Antivirus for Internet Email Gateways
|
|
804
743
|
(note the product changed its name from "Norton Antivirus for Internet Email Gateways" (NAVIEG) to
|
|
805
744
|
"Norton Antivirus for Gateways" (NAVGW) as of version 2.1
|
|
806
745
|
example: mailman.laughlin.af.mil SMTP NAVIEG 2.0.1; Sun, 29 Jul 2001 22:02:16 -0500 http://www.symantec.com
|
|
807
746
|
</description>
|
|
808
|
-
|
|
809
|
-
|
|
810
|
-
|
|
811
|
-
|
|
812
|
-
|
|
813
|
-
|
|
814
|
-
|
|
815
|
-
|
|
816
|
-
|
|
817
|
-
|
|
818
|
-
<description>
|
|
747
|
+
<param pos="0" name="service.vendor" value="Norton"/>
|
|
748
|
+
<param pos="0" name="service.family" value="Antivirus for Gateways"/>
|
|
749
|
+
<param pos="0" name="service.product" value="Antivirus for Gateways"/>
|
|
750
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
751
|
+
<param pos="1" name="host.name"/>
|
|
752
|
+
<param pos="2" name="service.version"/>
|
|
753
|
+
<param pos="3" name="system.time"/>
|
|
754
|
+
</fingerprint>
|
|
755
|
+
<fingerprint pattern="^([^ ]+) ESMTP service \(Netscape Messaging Server ([^ ]+\.[^ ]+) Patch ([^ ]+).*$">
|
|
756
|
+
<description>
|
|
819
757
|
Netscape Messaging Server
|
|
820
758
|
example: 220 mail.iasmail.net ESMTP service (Netscape Messaging Server 4.15 Patch 2 (built May 30 2000))
|
|
821
759
|
</description>
|
|
822
|
-
|
|
823
|
-
|
|
824
|
-
|
|
825
|
-
|
|
826
|
-
|
|
827
|
-
|
|
828
|
-
|
|
829
|
-
|
|
830
|
-
|
|
831
|
-
<description>
|
|
760
|
+
<param pos="0" name="service.vendor" value="Netscape"/>
|
|
761
|
+
<param pos="0" name="service.family" value="Messaging Server"/>
|
|
762
|
+
<param pos="0" name="service.product" value="Messaging Server"/>
|
|
763
|
+
<param pos="1" name="host.name"/>
|
|
764
|
+
<param pos="2" name="service.version"/>
|
|
765
|
+
<param pos="3" name="service.version.version"/>
|
|
766
|
+
</fingerprint>
|
|
767
|
+
<fingerprint pattern="^([^ ]+) ESMTP service \(Netscape Messaging Server ([^ ]+\.[^ ]+)\) ready (.+)$">
|
|
768
|
+
<description>
|
|
832
769
|
Netscape Messaging Server
|
|
833
770
|
</description>
|
|
834
|
-
|
|
835
|
-
|
|
836
|
-
|
|
837
|
-
|
|
838
|
-
|
|
839
|
-
|
|
840
|
-
|
|
841
|
-
|
|
842
|
-
|
|
843
|
-
|
|
844
|
-
<description>
|
|
771
|
+
<param pos="0" name="service.vendor" value="Netscape"/>
|
|
772
|
+
<param pos="0" name="service.family" value="Messaging Server"/>
|
|
773
|
+
<param pos="0" name="service.product" value="Messaging Server"/>
|
|
774
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
775
|
+
<param pos="1" name="host.name"/>
|
|
776
|
+
<param pos="2" name="service.version"/>
|
|
777
|
+
<param pos="3" name="system.time"/>
|
|
778
|
+
</fingerprint>
|
|
779
|
+
<fingerprint pattern="^([^ ]+) Lotus SMTP MTA Service Ready *$">
|
|
780
|
+
<description>
|
|
845
781
|
Lotus Notes 4 SMTP MTA
|
|
846
782
|
</description>
|
|
847
|
-
|
|
848
|
-
|
|
849
|
-
|
|
850
|
-
|
|
851
|
-
|
|
852
|
-
|
|
853
|
-
|
|
854
|
-
|
|
855
|
-
<description>
|
|
783
|
+
<param pos="0" name="service.vendor" value="Lotus"/>
|
|
784
|
+
<param pos="0" name="service.family" value="Lotus Domino"/>
|
|
785
|
+
<param pos="0" name="service.product" value="Lotus Domino"/>
|
|
786
|
+
<param pos="0" name="service.version" value="4"/>
|
|
787
|
+
<param pos="1" name="host.name"/>
|
|
788
|
+
</fingerprint>
|
|
789
|
+
<fingerprint pattern="^([^ ]+) ESMTP Service \(Lotus Domino Release (\d+\.\d+\.\w+)\) ready at (.+) *$">
|
|
790
|
+
<description>
|
|
856
791
|
Lotus Domino 5 SMTP MTA
|
|
857
792
|
220 foo.bar.com ESMTP Service (Lotus Domino Release 5.0.5) ready at Wed, 19 Dec 2001 19:54:55 -0500
|
|
858
793
|
</description>
|
|
859
|
-
|
|
860
|
-
|
|
861
|
-
|
|
862
|
-
|
|
863
|
-
|
|
864
|
-
|
|
865
|
-
|
|
866
|
-
|
|
867
|
-
|
|
868
|
-
|
|
869
|
-
<description>
|
|
794
|
+
<param pos="0" name="service.vendor" value="Lotus"/>
|
|
795
|
+
<param pos="0" name="service.family" value="Lotus Domino"/>
|
|
796
|
+
<param pos="0" name="service.product" value="Lotus Domino"/>
|
|
797
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
798
|
+
<param pos="1" name="host.name"/>
|
|
799
|
+
<param pos="2" name="service.version"/>
|
|
800
|
+
<param pos="3" name="system.time"/>
|
|
801
|
+
</fingerprint>
|
|
802
|
+
<fingerprint pattern="^([^ ]+) ESMTP Service \(Lotus Domino Release (\d+\.\w+)\) ready at (.+) *$">
|
|
803
|
+
<description>
|
|
870
804
|
Lotus Domino 5 SMTP MTA
|
|
871
805
|
example: 220 foo.bar.com ESMTP Service (Lotus Domino Release 5.0a) ready at Wed, 20 Jun 2001 08:59:17 +0200
|
|
872
806
|
</description>
|
|
873
|
-
|
|
874
|
-
|
|
875
|
-
|
|
876
|
-
|
|
877
|
-
|
|
878
|
-
|
|
879
|
-
|
|
880
|
-
|
|
881
|
-
|
|
882
|
-
|
|
883
|
-
<description>
|
|
807
|
+
<param pos="0" name="service.vendor" value="Lotus"/>
|
|
808
|
+
<param pos="0" name="service.family" value="Lotus Domino"/>
|
|
809
|
+
<param pos="0" name="service.product" value="Lotus Domino"/>
|
|
810
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
811
|
+
<param pos="1" name="host.name"/>
|
|
812
|
+
<param pos="2" name="service.version"/>
|
|
813
|
+
<param pos="3" name="system.time"/>
|
|
814
|
+
</fingerprint>
|
|
815
|
+
<fingerprint pattern="^([^ ]+) ESMTP Service \(Lotus Domino Release (\d+\.\d+\.\w+) \(Intl\)\) ready at (.+) *$">
|
|
816
|
+
<description>
|
|
884
817
|
Lotus Domino 5 SMTP MTA, International product version
|
|
885
818
|
example: 220 foo.bar.com ESMTP Service (Lotus Domino Release 5.0.5 (Intl)) ready at Tue, 6 Feb 2001 18:54:23 -0500
|
|
886
819
|
</description>
|
|
887
|
-
|
|
888
|
-
|
|
889
|
-
|
|
890
|
-
|
|
891
|
-
|
|
892
|
-
|
|
893
|
-
|
|
894
|
-
|
|
895
|
-
|
|
896
|
-
|
|
897
|
-
|
|
898
|
-
<description>
|
|
820
|
+
<param pos="0" name="service.vendor" value="Lotus"/>
|
|
821
|
+
<param pos="0" name="service.family" value="Lotus Domino"/>
|
|
822
|
+
<param pos="0" name="service.product" value="Lotus Domino"/>
|
|
823
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
824
|
+
<param pos="0" name="notes.intl" value="yes"/>
|
|
825
|
+
<param pos="1" name="host.name"/>
|
|
826
|
+
<param pos="2" name="service.version"/>
|
|
827
|
+
<param pos="3" name="system.time"/>
|
|
828
|
+
</fingerprint>
|
|
829
|
+
<fingerprint pattern="^([^ ]+) ESMTP Service \(Lotus Domino Build (\d+\.\d+)\) ready at (.+) *$">
|
|
830
|
+
<description>
|
|
899
831
|
Lotus Domino (some early build)
|
|
900
832
|
220 foo.bar.com ESMTP Service (Lotus Domino Build 166.1) ready at Tue, 6 Feb 2001 2
|
|
901
833
|
</description>
|
|
902
|
-
|
|
903
|
-
|
|
904
|
-
|
|
905
|
-
|
|
906
|
-
|
|
907
|
-
|
|
908
|
-
|
|
909
|
-
|
|
910
|
-
|
|
911
|
-
<description>
|
|
834
|
+
<param pos="0" name="service.vendor" value="Lotus"/>
|
|
835
|
+
<param pos="0" name="service.family" value="Lotus Domino"/>
|
|
836
|
+
<param pos="0" name="service.product" value="Lotus Domino"/>
|
|
837
|
+
<param pos="1" name="host.name"/>
|
|
838
|
+
<param pos="2" name="notes.build.version"/>
|
|
839
|
+
<param pos="3" name="system.time"/>
|
|
840
|
+
</fingerprint>
|
|
841
|
+
<fingerprint pattern="^Lotus Notes ESMTP Server X[^ ]+\.[^ ]+ on (.+) ready at (.+)\. *$">
|
|
842
|
+
<description>
|
|
912
843
|
Lotus Notes 4.x with SMTP MTA add-on
|
|
913
844
|
220 Lotus Notes ESMTP Server X1.0 on RedSox R45 Server/Red Sox/US ready at Fri, 15 Feb 2002 09:46:19 -0800.
|
|
914
845
|
</description>
|
|
915
|
-
|
|
916
|
-
|
|
917
|
-
|
|
918
|
-
|
|
919
|
-
|
|
920
|
-
|
|
921
|
-
|
|
922
|
-
|
|
923
|
-
|
|
924
|
-
<description>
|
|
846
|
+
<param pos="0" name="service.vendor" value="Lotus"/>
|
|
847
|
+
<param pos="0" name="service.family" value="Lotus Domino"/>
|
|
848
|
+
<param pos="0" name="service.product" value="Lotus Domino"/>
|
|
849
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
850
|
+
<param pos="1" name="host.name"/>
|
|
851
|
+
<param pos="2" name="system.time"/>
|
|
852
|
+
</fingerprint>
|
|
853
|
+
<fingerprint pattern="^([^ ]+) NTMail \(v(\d+\.\d+\.\d+)/([^ ]+)\) ready for ESMTP transfer *$">
|
|
854
|
+
<description>
|
|
925
855
|
NTMail http://www.gordano.com
|
|
926
856
|
example: 220 lilzmail.liwest.at NTMail (v4.30.0012/NU2182.02.1cf87970) ready for ESMTP transfer
|
|
927
857
|
example: 220 pluto.wvwc.edu NTMail (v5.06.0016/NT9445.00.28cc9615) ready for ESMTP transfer
|
|
928
858
|
</description>
|
|
929
|
-
|
|
930
|
-
|
|
931
|
-
|
|
932
|
-
|
|
933
|
-
|
|
934
|
-
|
|
935
|
-
|
|
936
|
-
|
|
937
|
-
|
|
938
|
-
<description>
|
|
859
|
+
<param pos="0" name="service.vendor" value="Gordano"/>
|
|
860
|
+
<param pos="0" name="service.family" value="NTMail"/>
|
|
861
|
+
<param pos="0" name="service.product" value="NTMail"/>
|
|
862
|
+
<param pos="1" name="host.name"/>
|
|
863
|
+
<param pos="2" name="service.version"/>
|
|
864
|
+
<param pos="3" name="ntmail.id"/>
|
|
865
|
+
</fingerprint>
|
|
866
|
+
<fingerprint pattern="^([^ ]+) WindowsNT SMTP Server v([^ ]+\.[^ ]+\.[^ ]+)/([^ ]+)/SP ESMTP ready at (.+) *$">
|
|
867
|
+
<description>
|
|
939
868
|
versions 3.x and earlier of NTMail http://www.gordano.com (it was called Internet Shopper's something or other)
|
|
940
869
|
example: 220 mail.Networkengineering WindowsNT SMTP Server v3.03.0018/1.aio1/SP ESMTP ready at Wed, 25 Jul 2001 23:03:11 -0400
|
|
941
870
|
example: 220 mars.wvwc.edu WindowsNT SMTP Server v3.03.0018/1.ajhf/SP ESMTP ready at Thu, 29 Oct 1998 18:01:30 -0500
|
|
@@ -945,885 +874,814 @@ The system or service fingerprint with the highest certainty overwrites the othe
|
|
|
945
874
|
example: 220 wwmerchant.osopinion.com WindowsNT SMTP Server v3.03.0017/4c.adur/SP ESMTP ready at Fri, 26 Mar 1999 13:20:30 -0700
|
|
946
875
|
example: 220 digital-hoon.tecdm.dmi.co.kr WindowsNT SMTP Server v3.02.07/2c.aaaj ready at Thu, 5 Dec 1996 22:46:12 +0000
|
|
947
876
|
</description>
|
|
948
|
-
|
|
949
|
-
|
|
950
|
-
|
|
951
|
-
|
|
952
|
-
|
|
953
|
-
|
|
954
|
-
|
|
955
|
-
|
|
956
|
-
|
|
957
|
-
|
|
958
|
-
|
|
959
|
-
|
|
960
|
-
|
|
961
|
-
|
|
962
|
-
|
|
963
|
-
|
|
964
|
-
|
|
965
|
-
|
|
966
|
-
|
|
967
|
-
|
|
968
|
-
|
|
969
|
-
|
|
970
|
-
|
|
971
|
-
|
|
972
|
-
|
|
973
|
-
<
|
|
974
|
-
|
|
975
|
-
|
|
976
|
-
|
|
977
|
-
|
|
978
|
-
|
|
979
|
-
|
|
980
|
-
|
|
981
|
-
|
|
982
|
-
|
|
983
|
-
|
|
984
|
-
<fingerprint pattern="^([^ ]+) Postfix \(Postfix-([^ ]+)-([^ ]+)\) \(([^ ]+)\) *$">
|
|
985
|
-
<!--
|
|
986
|
-
220 foo.bar.com ESMTP Postfix (Postfix-19991231-pl08) (Linux-Mandrake)
|
|
987
|
-
-->
|
|
988
|
-
<description>
|
|
877
|
+
<param pos="0" name="service.vendor" value="Gordano"/>
|
|
878
|
+
<param pos="0" name="service.family" value="NTMail"/>
|
|
879
|
+
<param pos="0" name="service.product" value="NTMail"/>
|
|
880
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
881
|
+
<param pos="1" name="host.name"/>
|
|
882
|
+
<param pos="2" name="service.version"/>
|
|
883
|
+
<param pos="3" name="ntmail.id"/>
|
|
884
|
+
<param pos="4" name="system.time"/>
|
|
885
|
+
</fingerprint>
|
|
886
|
+
<fingerprint pattern="^(\S+)(?: UCX)? V\S+, OpenVMS V(\S+) (\S+) ready at .*$">
|
|
887
|
+
<description>Some unknown mail server on OpenVMS</description>
|
|
888
|
+
<example host.name="example.com" os.arch="IA64" os.version="8.4">example.com V5.7-ECO4, OpenVMS V8.4 IA64 ready at Wed, 20 May 2015 01:22:32 +0100 (BST)</example>
|
|
889
|
+
<example host.name="example.com" os.arch="Alpha" os.version="7.3-2">example.com V5.4-15E, OpenVMS V7.3-2 Alpha ready at Wed, 20 May 2015 01:22:18 +0100 (BST)</example>
|
|
890
|
+
<example host.name="example.com" os.arch="VAX" os.version="6.2">example.com UCX V4.2-21I, OpenVMS V6.2 VAX ready at Wed, 20 May 2015 01:15:16 GMT</example>
|
|
891
|
+
<example host.name="example.com" os.arch="Alpha" os.version="6.2-1H3">example.com UCX V4.2-21I, OpenVMS V6.2-1H3 Alpha ready at Wed, 20 May 2015 00:55:37 GMT</example>
|
|
892
|
+
<param pos="1" name="host.name"/>
|
|
893
|
+
<param pos="0" name="os.vendor" value="HP"/>
|
|
894
|
+
<param pos="0" name="os.family" value="OpenVMS"/>
|
|
895
|
+
<param pos="0" name="os.product" value="OpenVMS"/>
|
|
896
|
+
<param pos="0" name="os.device" value="General"/>
|
|
897
|
+
<param pos="2" name="os.version"/>
|
|
898
|
+
<param pos="3" name="os.arch"/>
|
|
899
|
+
</fingerprint>
|
|
900
|
+
<fingerprint pattern="^(\S+) E?SMTP PMailServer(?: \[Free Edition\]) ([\d\.]+); (\S{3}, \d{2} \S{3} \d{4} \d{2}:\d{2}:\d{2})$">
|
|
901
|
+
<description>A.K.I PMail</description>
|
|
902
|
+
<example host.name="example.com" service.version="1.91">example.com ESMTP PMailServer [Free Edition] 1.91; Fri, 22 May 2015 02:04:56</example>
|
|
903
|
+
<param pos="0" name="service.vendor" value="A.K.I Software"/>
|
|
904
|
+
<param pos="0" name="service.product" value="PMail Server"/>
|
|
905
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss"/>
|
|
906
|
+
<param pos="1" name="host.name"/>
|
|
907
|
+
<param pos="2" name="service.version"/>
|
|
908
|
+
<param pos="3" name="system.time"/>
|
|
909
|
+
</fingerprint>
|
|
910
|
+
<fingerprint pattern="^([^ ]+) Postfix \(Postfix-([^ ]+)-([^ ]+)\) \(([^ ]+)\) *$">
|
|
911
|
+
<description>
|
|
989
912
|
Postfix (2 version ids, followed by os)
|
|
990
913
|
</description>
|
|
991
|
-
|
|
992
|
-
|
|
993
|
-
|
|
994
|
-
|
|
995
|
-
|
|
996
|
-
|
|
997
|
-
|
|
998
|
-
|
|
999
|
-
|
|
1000
|
-
<!--
|
|
1001
|
-
220 foo.bar.com ESMTP Postfix (Postfix-20000531-Snapshot)
|
|
1002
|
-
-->
|
|
1003
|
-
<description>
|
|
914
|
+
<param pos="0" name="service.family" value="Postfix"/>
|
|
915
|
+
<param pos="0" name="service.product" value="Postfix"/>
|
|
916
|
+
<param pos="1" name="host.name"/>
|
|
917
|
+
<param pos="2" name="service.version"/>
|
|
918
|
+
<param pos="3" name="service.version.version"/>
|
|
919
|
+
<param pos="4" name="postfix.os.info"/>
|
|
920
|
+
</fingerprint>
|
|
921
|
+
<fingerprint pattern="^([^ ]+) ESMTP Postfix \(Postfix-([^ ]+)-([^ ]+)\) *$">
|
|
922
|
+
<description>
|
|
1004
923
|
Postfix (2 version numbers)
|
|
1005
924
|
</description>
|
|
1006
|
-
|
|
1007
|
-
|
|
1008
|
-
|
|
1009
|
-
|
|
1010
|
-
|
|
1011
|
-
|
|
1012
|
-
|
|
1013
|
-
|
|
1014
|
-
<!--
|
|
1015
|
-
220 foo.bar.com ESMTP Postfix (Snapshot-20001121)
|
|
1016
|
-
-->
|
|
1017
|
-
<description>
|
|
925
|
+
<param pos="0" name="service.family" value="Postfix"/>
|
|
926
|
+
<param pos="0" name="service.product" value="Postfix"/>
|
|
927
|
+
<param pos="1" name="host.name"/>
|
|
928
|
+
<param pos="2" name="service.version"/>
|
|
929
|
+
<param pos="3" name="service.version.version"/>
|
|
930
|
+
</fingerprint>
|
|
931
|
+
<fingerprint pattern="^([^ ]+) ESMTP Postfix \(([^ ]+)-([^ ]+)\)$">
|
|
932
|
+
<description>
|
|
1018
933
|
Postfix (2 version numbers )
|
|
1019
934
|
</description>
|
|
1020
|
-
|
|
1021
|
-
|
|
1022
|
-
|
|
1023
|
-
|
|
1024
|
-
|
|
1025
|
-
|
|
1026
|
-
|
|
1027
|
-
|
|
1028
|
-
<description>
|
|
935
|
+
<param pos="0" name="service.family" value="Postfix"/>
|
|
936
|
+
<param pos="0" name="service.product" value="Postfix"/>
|
|
937
|
+
<param pos="1" name="host.name"/>
|
|
938
|
+
<param pos="2" name="service.version"/>
|
|
939
|
+
<param pos="3" name="service.version.version"/>
|
|
940
|
+
</fingerprint>
|
|
941
|
+
<fingerprint pattern="^([^ ]+) Postfix \(Postfix-([^ ]+)\) \(([^ ]+)\) *$">
|
|
942
|
+
<description>
|
|
1029
943
|
Postfix (1 version number)
|
|
1030
944
|
</description>
|
|
1031
|
-
|
|
1032
|
-
|
|
1033
|
-
|
|
1034
|
-
|
|
1035
|
-
|
|
1036
|
-
|
|
1037
|
-
|
|
1038
|
-
|
|
1039
|
-
<description>
|
|
945
|
+
<param pos="0" name="service.family" value="Postfix"/>
|
|
946
|
+
<param pos="0" name="service.product" value="Postfix"/>
|
|
947
|
+
<param pos="1" name="host.name"/>
|
|
948
|
+
<param pos="2" name="service.version"/>
|
|
949
|
+
<param pos="3" name="postfix.os.info"/>
|
|
950
|
+
</fingerprint>
|
|
951
|
+
<fingerprint pattern="^([^ ]+) E?SMTP Postfix \(Ubuntu\)$">
|
|
952
|
+
<description>
|
|
1040
953
|
Postfix Ubuntu package.
|
|
1041
954
|
</description>
|
|
1042
|
-
|
|
1043
|
-
|
|
1044
|
-
|
|
1045
|
-
|
|
1046
|
-
|
|
1047
|
-
|
|
1048
|
-
|
|
1049
|
-
|
|
1050
|
-
|
|
1051
|
-
|
|
1052
|
-
<
|
|
1053
|
-
<description>
|
|
955
|
+
<example>foo.bar.com ESMTP Postfix (Ubuntu)</example>
|
|
956
|
+
<param pos="0" name="service.family" value="Postfix"/>
|
|
957
|
+
<param pos="0" name="service.product" value="Postfix"/>
|
|
958
|
+
<param pos="1" name="host.name"/>
|
|
959
|
+
<param pos="0" name="os.vendor" value="Ubuntu"/>
|
|
960
|
+
<param pos="0" name="os.device" value="General"/>
|
|
961
|
+
<param pos="0" name="os.family" value="Linux"/>
|
|
962
|
+
<param pos="0" name="os.product" value="Linux"/>
|
|
963
|
+
</fingerprint>
|
|
964
|
+
<fingerprint pattern="^([^ ]+) E?SMTP Postfix \(Debian/GNU\)$">
|
|
965
|
+
<description>
|
|
1054
966
|
Postfix Debian package.
|
|
1055
967
|
</description>
|
|
1056
|
-
|
|
1057
|
-
|
|
1058
|
-
|
|
1059
|
-
|
|
1060
|
-
|
|
1061
|
-
|
|
1062
|
-
|
|
1063
|
-
|
|
1064
|
-
|
|
1065
|
-
|
|
1066
|
-
|
|
1067
|
-
<description>
|
|
968
|
+
<example>foo.bar.com ESMTP Postfix (Debian/GNU)</example>
|
|
969
|
+
<param pos="0" name="service.family" value="Postfix"/>
|
|
970
|
+
<param pos="0" name="service.product" value="Postfix"/>
|
|
971
|
+
<param pos="1" name="host.name"/>
|
|
972
|
+
<param pos="0" name="os.vendor" value="Debian"/>
|
|
973
|
+
<param pos="0" name="os.device" value="General"/>
|
|
974
|
+
<param pos="0" name="os.family" value="Linux"/>
|
|
975
|
+
<param pos="0" name="os.product" value="Linux"/>
|
|
976
|
+
</fingerprint>
|
|
977
|
+
<fingerprint pattern="^([^ ]+) ESMTP.* Postfix *\(.+\) *$">
|
|
978
|
+
<description>
|
|
1068
979
|
Generic Postfix banner with amusing comments in parentheses
|
|
1069
980
|
</description>
|
|
1070
|
-
|
|
1071
|
-
|
|
1072
|
-
|
|
1073
|
-
|
|
1074
|
-
|
|
1075
|
-
|
|
1076
|
-
|
|
1077
|
-
<description>
|
|
981
|
+
<example>foo.bar.com ESMTP Postfix (lol)</example>
|
|
982
|
+
<param pos="0" name="service.family" value="Postfix"/>
|
|
983
|
+
<param pos="0" name="service.product" value="Postfix"/>
|
|
984
|
+
<param pos="1" name="host.name"/>
|
|
985
|
+
</fingerprint>
|
|
986
|
+
<fingerprint pattern="^([^ ]+) ESMTP.* Postfix *$">
|
|
987
|
+
<description>
|
|
1078
988
|
Generic Postfix banner.
|
|
1079
989
|
</description>
|
|
1080
|
-
|
|
1081
|
-
|
|
1082
|
-
|
|
1083
|
-
|
|
1084
|
-
|
|
1085
|
-
|
|
1086
|
-
|
|
1087
|
-
<description>
|
|
990
|
+
<example>foo.bar.com ESMTP Postfix</example>
|
|
991
|
+
<param pos="0" name="service.family" value="Postfix"/>
|
|
992
|
+
<param pos="0" name="service.product" value="Postfix"/>
|
|
993
|
+
<param pos="1" name="host.name"/>
|
|
994
|
+
</fingerprint>
|
|
995
|
+
<fingerprint pattern="^([^ ]+) ESMTP server \(Post\.Office v([^ ]+) release (.+) ID# ([^ ]+)\) ready (.+) *$">
|
|
996
|
+
<description>
|
|
1088
997
|
Post.Office (3 version numbers)
|
|
1089
998
|
</description>
|
|
1090
|
-
|
|
1091
|
-
|
|
1092
|
-
|
|
1093
|
-
|
|
1094
|
-
|
|
1095
|
-
|
|
1096
|
-
|
|
1097
|
-
|
|
1098
|
-
|
|
1099
|
-
|
|
1100
|
-
|
|
1101
|
-
|
|
1102
|
-
<description>
|
|
999
|
+
<example host.name="192.168.1.1" service.version="3.1" postoffice.build="PO205e" postoffice.id="0-42000U100L2S100" system.time="Tue, 6 Feb 2001 19:38:32 +0100">192.168.1.1 ESMTP server (Post.Office v3.1 release PO205e ID# 0-42000U100L2S100) ready Tue, 6 Feb 2001 19:38:32 +0100</example>
|
|
1000
|
+
<param pos="0" name="service.family" value="Post.Office"/>
|
|
1001
|
+
<param pos="0" name="service.product" value="Post.Office"/>
|
|
1002
|
+
<param pos="2" name="service.version"/>
|
|
1003
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1004
|
+
<param pos="1" name="host.name"/>
|
|
1005
|
+
<param pos="3" name="postoffice.build"/>
|
|
1006
|
+
<param pos="4" name="postoffice.id"/>
|
|
1007
|
+
<param pos="5" name="system.time"/>
|
|
1008
|
+
</fingerprint>
|
|
1009
|
+
<fingerprint pattern="^([^ ]+) ESMTP server \(P|post\.O|office v([^ ]+\.[^ ]+) (.+) ID# ([^ ]+)\) ready (.+) *$">
|
|
1010
|
+
<description>
|
|
1103
1011
|
Post.Office lacking word "release" before release tag
|
|
1104
1012
|
</description>
|
|
1105
|
-
|
|
1106
|
-
|
|
1107
|
-
|
|
1108
|
-
|
|
1109
|
-
|
|
1110
|
-
|
|
1111
|
-
|
|
1112
|
-
|
|
1113
|
-
|
|
1114
|
-
|
|
1115
|
-
|
|
1116
|
-
<description>
|
|
1013
|
+
<param pos="0" name="service.family" value="Post.Office"/>
|
|
1014
|
+
<param pos="0" name="service.product" value="Post.Office"/>
|
|
1015
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1016
|
+
<param pos="1" name="host.name"/>
|
|
1017
|
+
<param pos="2" name="service.version"/>
|
|
1018
|
+
<param pos="3" name="postoffice.build"/>
|
|
1019
|
+
<param pos="4" name="postoffice.id"/>
|
|
1020
|
+
<param pos="5" name="system.time"/>
|
|
1021
|
+
</fingerprint>
|
|
1022
|
+
<fingerprint pattern="^([^ ]+) Generic SMTP handler *$">
|
|
1023
|
+
<description>
|
|
1117
1024
|
Raptor Firewall
|
|
1118
1025
|
example: 220 foo.bar.com Generic SMTP handler
|
|
1119
1026
|
</description>
|
|
1120
|
-
|
|
1121
|
-
|
|
1122
|
-
|
|
1123
|
-
|
|
1124
|
-
|
|
1125
|
-
|
|
1126
|
-
|
|
1127
|
-
|
|
1128
|
-
|
|
1129
|
-
|
|
1130
|
-
|
|
1131
|
-
|
|
1132
|
-
|
|
1133
|
-
<fingerprint pattern="^([^ ]+) +ESMTP +Sendmail +([^ ]+) \(PHNE_([^ ]+)\) */ *(.+); *(.+) \(.+\)$">
|
|
1134
|
-
<description>
|
|
1027
|
+
<param pos="0" name="service.product" value="raptor"/>
|
|
1028
|
+
<param pos="1" name="host.name"/>
|
|
1029
|
+
</fingerprint>
|
|
1030
|
+
<fingerprint pattern="^(\S+) SAP (\S+) E?SMTP service ready$">
|
|
1031
|
+
<description>SAP SMTP Server</description>
|
|
1032
|
+
<example host.name="example.com" service.version="8.04(53)">example.com SAP 8.04(53) ESMTP service ready</example>
|
|
1033
|
+
<param pos="0" name="service.vendor" value="SAP"/>
|
|
1034
|
+
<param pos="0" name="service.product" value="SMTP"/>
|
|
1035
|
+
<param pos="2" name="service.version"/>
|
|
1036
|
+
<param pos="1" name="host.name"/>
|
|
1037
|
+
</fingerprint>
|
|
1038
|
+
<fingerprint pattern="^([^ ]+) +ESMTP +Sendmail +([^ ]+) \(PHNE_([^ ]+)\) */ *(.+); *(.+) \(.+\)$">
|
|
1039
|
+
<description>
|
|
1135
1040
|
sendmail on HPUX with a PHNE (HP Networking patch) installed
|
|
1136
1041
|
</description>
|
|
1137
|
-
|
|
1138
|
-
|
|
1139
|
-
|
|
1140
|
-
|
|
1141
|
-
|
|
1142
|
-
|
|
1143
|
-
|
|
1144
|
-
|
|
1145
|
-
|
|
1146
|
-
|
|
1147
|
-
|
|
1148
|
-
|
|
1149
|
-
|
|
1150
|
-
|
|
1151
|
-
|
|
1152
|
-
|
|
1153
|
-
<description>
|
|
1042
|
+
<example>foo.bar.com ESMTP Sendmail 8.8.6 (PHNE_14041)/8.7.1; Tue, 6 Feb 2001 10:04:32 -0300 (SAT)</example>
|
|
1043
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1044
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1045
|
+
<param pos="0" name="os.vendor" value="HP"/>
|
|
1046
|
+
<param pos="0" name="os.family" value="HP-UX"/>
|
|
1047
|
+
<param pos="0" name="os.device" value="General"/>
|
|
1048
|
+
<param pos="0" name="os.product" value="HP-UX"/>
|
|
1049
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1050
|
+
<param pos="1" name="host.name"/>
|
|
1051
|
+
<param pos="2" name="service.version"/>
|
|
1052
|
+
<param pos="3" name="sendmail.hpux.phne.version"/>
|
|
1053
|
+
<param pos="4" name="sendmail.config.version"/>
|
|
1054
|
+
<param pos="5" name="system.time"/>
|
|
1055
|
+
</fingerprint>
|
|
1056
|
+
<fingerprint pattern="^(\S+) ESMTP Sendmail \S+ version ([\d\.]+) - Revision \S+ HP-UX([\d\.]+).*(\S{3}, \d{2} \S{3} \d{4} \d{2}:\d{2}:\d{2} \S{3})$">
|
|
1057
|
+
<description>
|
|
1154
1058
|
sendmail on HPUX
|
|
1155
1059
|
</description>
|
|
1156
|
-
|
|
1157
|
-
|
|
1158
|
-
|
|
1159
|
-
|
|
1160
|
-
|
|
1161
|
-
|
|
1162
|
-
|
|
1163
|
-
|
|
1164
|
-
|
|
1165
|
-
|
|
1166
|
-
|
|
1167
|
-
|
|
1168
|
-
|
|
1169
|
-
|
|
1170
|
-
|
|
1171
|
-
<description>
|
|
1060
|
+
<example host.name="example.com" os.version="11.31" service.version="8.13.3">example.com ESMTP Sendmail @(#)Sendmail version 8.13.3 - Revision 1.004:: HP-UX11.31 - 03rd February,2010/8.11.1; Wed, 20 May 2015 23:35:38 GMT</example>
|
|
1061
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1062
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1063
|
+
<param pos="0" name="os.vendor" value="HP"/>
|
|
1064
|
+
<param pos="0" name="os.family" value="HP-UX"/>
|
|
1065
|
+
<param pos="0" name="os.device" value="General"/>
|
|
1066
|
+
<param pos="0" name="os.product" value="HP-UX"/>
|
|
1067
|
+
<param pos="3" name="os.version"/>
|
|
1068
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1069
|
+
<param pos="1" name="host.name"/>
|
|
1070
|
+
<param pos="2" name="service.version"/>
|
|
1071
|
+
<param pos="4" name="system.time"/>
|
|
1072
|
+
</fingerprint>
|
|
1073
|
+
<fingerprint pattern="^([^ ]+) +ESMTP +Sendmail +([^ ]+)/UW([^ ]+) ready at *(.+) \(.+\) *$">
|
|
1074
|
+
<description>
|
|
1172
1075
|
sendmail on unixware
|
|
1173
1076
|
</description>
|
|
1174
|
-
|
|
1175
|
-
|
|
1176
|
-
|
|
1177
|
-
|
|
1178
|
-
|
|
1179
|
-
|
|
1180
|
-
|
|
1181
|
-
|
|
1182
|
-
|
|
1183
|
-
|
|
1184
|
-
|
|
1185
|
-
|
|
1186
|
-
|
|
1187
|
-
|
|
1188
|
-
|
|
1189
|
-
<description>
|
|
1077
|
+
<example>foo.bar.com ESMTP Sendmail 8.8.7/UW7.1.0 ready at Tue, 6 Feb 2001 16:39:30 -0300 (GMT-0300)</example>
|
|
1078
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1079
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1080
|
+
<param pos="0" name="os.vendor" value="SCO"/>
|
|
1081
|
+
<param pos="0" name="os.family" value="UnixWare"/>
|
|
1082
|
+
<param pos="0" name="os.device" value="General"/>
|
|
1083
|
+
<param pos="0" name="os.product" value="UnixWare"/>
|
|
1084
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1085
|
+
<param pos="1" name="host.name"/>
|
|
1086
|
+
<param pos="2" name="service.version"/>
|
|
1087
|
+
<param pos="3" name="os.version"/>
|
|
1088
|
+
<param pos="4" name="system.time"/>
|
|
1089
|
+
</fingerprint>
|
|
1090
|
+
<fingerprint pattern="^([^ ]+) ESMTP Sendmail AIX([^/]+)/UCB ([^;]+); (.+) \(.+\)$">
|
|
1091
|
+
<description>
|
|
1190
1092
|
sendmail on AIX
|
|
1191
1093
|
</description>
|
|
1192
|
-
|
|
1193
|
-
|
|
1194
|
-
|
|
1195
|
-
|
|
1196
|
-
|
|
1197
|
-
|
|
1198
|
-
|
|
1199
|
-
|
|
1200
|
-
|
|
1201
|
-
|
|
1202
|
-
|
|
1203
|
-
|
|
1204
|
-
|
|
1205
|
-
|
|
1206
|
-
|
|
1207
|
-
<description>
|
|
1094
|
+
<example>foo.bar.com ESMTP Sendmail AIX4.2/UCB 8.7; Sun, 29 Jul 2001 22:34:37 -0400 (EDT)</example>
|
|
1095
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1096
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1097
|
+
<param pos="0" name="os.vendor" value="IBM"/>
|
|
1098
|
+
<param pos="0" name="os.family" value="AIX"/>
|
|
1099
|
+
<param pos="0" name="os.device" value="General"/>
|
|
1100
|
+
<param pos="0" name="os.product" value="AIX"/>
|
|
1101
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1102
|
+
<param pos="1" name="host.name"/>
|
|
1103
|
+
<param pos="2" name="os.version"/>
|
|
1104
|
+
<param pos="3" name="service.version"/>
|
|
1105
|
+
<param pos="4" name="system.time"/>
|
|
1106
|
+
</fingerprint>
|
|
1107
|
+
<fingerprint pattern="^([^ ]+) Sendmail AIX([^/]+)/UCB ([^/]+)/([^ ]+) ready at (.+)$">
|
|
1108
|
+
<description>
|
|
1208
1109
|
sendmail on AIX
|
|
1209
1110
|
</description>
|
|
1210
|
-
|
|
1211
|
-
|
|
1212
|
-
|
|
1213
|
-
|
|
1214
|
-
|
|
1215
|
-
|
|
1216
|
-
|
|
1217
|
-
|
|
1218
|
-
|
|
1219
|
-
|
|
1220
|
-
|
|
1221
|
-
|
|
1222
|
-
|
|
1223
|
-
|
|
1224
|
-
|
|
1225
|
-
|
|
1226
|
-
<description>
|
|
1111
|
+
<example>foo.bar.com Sendmail AIX 4.1/UCB 5.64/4.03 ready at Mon, 30 Jul 2001 00:42:21 -0500</example>
|
|
1112
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1113
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1114
|
+
<param pos="0" name="os.vendor" value="IBM"/>
|
|
1115
|
+
<param pos="0" name="os.family" value="AIX"/>
|
|
1116
|
+
<param pos="0" name="os.device" value="General"/>
|
|
1117
|
+
<param pos="0" name="os.product" value="AIX"/>
|
|
1118
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1119
|
+
<param pos="1" name="host.name"/>
|
|
1120
|
+
<param pos="2" name="os.version"/>
|
|
1121
|
+
<param pos="3" name="service.version"/>
|
|
1122
|
+
<param pos="4" name="sendmail.config.version"/>
|
|
1123
|
+
<param pos="5" name="system.time"/>
|
|
1124
|
+
</fingerprint>
|
|
1125
|
+
<fingerprint pattern="^([^ ]+) ESMTP Sendmail AIX([^/]+)/([^/]+)/([^;]+); (.+)(?: \(.+\))?$">
|
|
1126
|
+
<description>
|
|
1227
1127
|
sendmail on AIX
|
|
1228
1128
|
</description>
|
|
1229
|
-
|
|
1230
|
-
|
|
1231
|
-
|
|
1232
|
-
|
|
1233
|
-
|
|
1234
|
-
|
|
1235
|
-
|
|
1236
|
-
|
|
1237
|
-
|
|
1238
|
-
|
|
1239
|
-
|
|
1240
|
-
|
|
1241
|
-
|
|
1242
|
-
|
|
1243
|
-
|
|
1244
|
-
|
|
1245
|
-
|
|
1246
|
-
<description>
|
|
1129
|
+
<example host.name="example.com" os.version="4.2" service.version="8.7" sendmail.config.version="8.8">example.com ESMTP Sendmail AIX4.2/8.7/8.8; Sun, 29 Jul 2001 22:34:37 -0400 (EDT)</example>
|
|
1130
|
+
<example host.name="example.com" os.version="5.1" service.version="8.11.6p2" sendmail.config.version="8.11.0">example.com ESMTP Sendmail AIX5.1/8.11.6p2/8.11.0; Fri, 28 Aug 1970 19:42:05 -0800</example>
|
|
1131
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1132
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1133
|
+
<param pos="0" name="os.vendor" value="IBM"/>
|
|
1134
|
+
<param pos="0" name="os.family" value="AIX"/>
|
|
1135
|
+
<param pos="0" name="os.device" value="General"/>
|
|
1136
|
+
<param pos="0" name="os.product" value="AIX"/>
|
|
1137
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1138
|
+
<param pos="1" name="host.name"/>
|
|
1139
|
+
<param pos="2" name="os.version"/>
|
|
1140
|
+
<param pos="3" name="service.version"/>
|
|
1141
|
+
<param pos="4" name="sendmail.config.version"/>
|
|
1142
|
+
<param pos="5" name="system.time"/>
|
|
1143
|
+
</fingerprint>
|
|
1144
|
+
<fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/([^/]+)/SuSE Linux ([^;]+); (.+)$">
|
|
1145
|
+
<description>
|
|
1247
1146
|
sendmail on suse
|
|
1248
1147
|
</description>
|
|
1249
|
-
|
|
1250
|
-
|
|
1251
|
-
|
|
1252
|
-
|
|
1253
|
-
|
|
1254
|
-
|
|
1255
|
-
|
|
1256
|
-
|
|
1257
|
-
|
|
1258
|
-
|
|
1259
|
-
|
|
1260
|
-
|
|
1261
|
-
|
|
1262
|
-
|
|
1263
|
-
|
|
1264
|
-
|
|
1265
|
-
<description>
|
|
1148
|
+
<example>foo.bar.com ESMTP Sendmail 8.9.3/8.9.3/SuSE Linux 8.9.3-0.1; Mon, 30 Jul 2001 04:48:54 +0200</example>
|
|
1149
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1150
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1151
|
+
<param pos="0" name="os.vendor" value="SuSE"/>
|
|
1152
|
+
<param pos="0" name="os.family" value="Linux"/>
|
|
1153
|
+
<param pos="0" name="os.device" value="General"/>
|
|
1154
|
+
<param pos="0" name="os.product" value="Linux"/>
|
|
1155
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1156
|
+
<param pos="1" name="host.name"/>
|
|
1157
|
+
<param pos="2" name="service.version"/>
|
|
1158
|
+
<param pos="3" name="sendmail.config.version"/>
|
|
1159
|
+
<param pos="4" name="sendmail.vendor.version"/>
|
|
1160
|
+
<param pos="5" name="system.time"/>
|
|
1161
|
+
</fingerprint>
|
|
1162
|
+
<fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^ ]+)\+Sun/([^ ]+); (.+)$">
|
|
1163
|
+
<description>
|
|
1266
1164
|
sendmail on Solaris
|
|
1267
1165
|
</description>
|
|
1268
|
-
|
|
1269
|
-
|
|
1270
|
-
|
|
1271
|
-
|
|
1272
|
-
|
|
1273
|
-
|
|
1274
|
-
|
|
1275
|
-
|
|
1276
|
-
|
|
1277
|
-
|
|
1278
|
-
|
|
1279
|
-
|
|
1280
|
-
|
|
1281
|
-
|
|
1282
|
-
|
|
1283
|
-
<description>
|
|
1166
|
+
<example>foo.bar.com ESMTP Sendmail 8.9.3+Sun/8.9.1; Mon, 30 Jul 2001 02:50:22 GMT</example>
|
|
1167
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1168
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1169
|
+
<param pos="0" name="os.vendor" value="Sun"/>
|
|
1170
|
+
<param pos="0" name="os.family" value="Solaris"/>
|
|
1171
|
+
<param pos="0" name="os.device" value="General"/>
|
|
1172
|
+
<param pos="0" name="os.product" value="Solaris"/>
|
|
1173
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1174
|
+
<param pos="1" name="host.name"/>
|
|
1175
|
+
<param pos="2" name="service.version"/>
|
|
1176
|
+
<param pos="3" name="sendmail.config.version"/>
|
|
1177
|
+
<param pos="4" name="system.time"/>
|
|
1178
|
+
</fingerprint>
|
|
1179
|
+
<fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^ ]+)\+Sun/([^ ]+) ready at (.+) \(.+\)$">
|
|
1180
|
+
<description>
|
|
1284
1181
|
sendmail on Solaris
|
|
1285
1182
|
</description>
|
|
1286
|
-
|
|
1287
|
-
|
|
1288
|
-
|
|
1289
|
-
|
|
1290
|
-
|
|
1291
|
-
|
|
1292
|
-
|
|
1293
|
-
|
|
1294
|
-
|
|
1295
|
-
|
|
1296
|
-
|
|
1297
|
-
|
|
1298
|
-
|
|
1299
|
-
|
|
1300
|
-
|
|
1301
|
-
<description>
|
|
1183
|
+
<example>foo.bar.com ESMTP Sendmail 8.8.8+Sun/8.6.4 ready at Thu, 15 Nov 2000 11:40:32 -0800 (PST)</example>
|
|
1184
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1185
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1186
|
+
<param pos="0" name="os.vendor" value="Sun"/>
|
|
1187
|
+
<param pos="0" name="os.family" value="Solaris"/>
|
|
1188
|
+
<param pos="0" name="os.device" value="General"/>
|
|
1189
|
+
<param pos="0" name="os.product" value="Solaris"/>
|
|
1190
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1191
|
+
<param pos="1" name="host.name"/>
|
|
1192
|
+
<param pos="2" name="service.version"/>
|
|
1193
|
+
<param pos="3" name="sendmail.config.version"/>
|
|
1194
|
+
<param pos="4" name="system.time"/>
|
|
1195
|
+
</fingerprint>
|
|
1196
|
+
<fingerprint pattern="^([^ ]+) ESMTP Debian Sendmail ([^/]+)/([^/]+)/Debian ([^/]+); (.+) *$">
|
|
1197
|
+
<description>
|
|
1302
1198
|
sendmail on debian
|
|
1303
1199
|
</description>
|
|
1304
|
-
|
|
1305
|
-
|
|
1306
|
-
|
|
1307
|
-
|
|
1308
|
-
|
|
1309
|
-
|
|
1310
|
-
|
|
1311
|
-
|
|
1312
|
-
|
|
1313
|
-
|
|
1314
|
-
|
|
1315
|
-
|
|
1316
|
-
|
|
1317
|
-
|
|
1318
|
-
|
|
1319
|
-
|
|
1320
|
-
<description>
|
|
1200
|
+
<example>foo.bar.com ESMTP Debian Sendmail 8.12.0.Beta7/8.12.0.Beta7/Debian 8.12.0.Beta7-1; Sun, 29 Jul 2001 18:52:20 -0800</example>
|
|
1201
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1202
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1203
|
+
<param pos="0" name="os.vendor" value="Debian"/>
|
|
1204
|
+
<param pos="0" name="os.family" value="Linux"/>
|
|
1205
|
+
<param pos="0" name="os.device" value="General"/>
|
|
1206
|
+
<param pos="0" name="os.product" value="Linux"/>
|
|
1207
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1208
|
+
<param pos="1" name="host.name"/>
|
|
1209
|
+
<param pos="2" name="service.version"/>
|
|
1210
|
+
<param pos="3" name="sendmail.config.version"/>
|
|
1211
|
+
<param pos="4" name="sendmail.vendor.version"/>
|
|
1212
|
+
<param pos="5" name="system.time"/>
|
|
1213
|
+
</fingerprint>
|
|
1214
|
+
<fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/([^/]+)/Debian ([^/]+); (.+) *$">
|
|
1215
|
+
<description>
|
|
1321
1216
|
sendmail on debian
|
|
1322
1217
|
</description>
|
|
1323
|
-
|
|
1324
|
-
|
|
1325
|
-
|
|
1326
|
-
|
|
1327
|
-
|
|
1328
|
-
|
|
1329
|
-
|
|
1330
|
-
|
|
1331
|
-
|
|
1332
|
-
|
|
1333
|
-
|
|
1334
|
-
|
|
1335
|
-
|
|
1336
|
-
|
|
1337
|
-
|
|
1338
|
-
|
|
1339
|
-
<description>
|
|
1218
|
+
<example>foo.bar.com ESMTP Sendmail 8.11.0/8.9.3/Debian 8.9.3-21; Sun, 29 Jul 2001 19:51:00 -0700</example>
|
|
1219
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1220
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1221
|
+
<param pos="0" name="os.vendor" value="Debian"/>
|
|
1222
|
+
<param pos="0" name="os.family" value="Linux"/>
|
|
1223
|
+
<param pos="0" name="os.device" value="General"/>
|
|
1224
|
+
<param pos="0" name="os.product" value="Linux"/>
|
|
1225
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1226
|
+
<param pos="1" name="host.name"/>
|
|
1227
|
+
<param pos="2" name="service.version"/>
|
|
1228
|
+
<param pos="3" name="sendmail.config.version"/>
|
|
1229
|
+
<param pos="4" name="sendmail.vendor.version"/>
|
|
1230
|
+
<param pos="5" name="system.time"/>
|
|
1231
|
+
</fingerprint>
|
|
1232
|
+
<fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/[^/]+/Debian-\dubuntu[^ ]*; (.+); .*$">
|
|
1233
|
+
<description>
|
|
1340
1234
|
Sendmail for Ubuntu
|
|
1341
1235
|
</description>
|
|
1342
|
-
|
|
1343
|
-
|
|
1344
|
-
|
|
1345
|
-
|
|
1346
|
-
|
|
1347
|
-
|
|
1348
|
-
|
|
1349
|
-
|
|
1350
|
-
|
|
1351
|
-
|
|
1352
|
-
|
|
1353
|
-
|
|
1354
|
-
|
|
1355
|
-
|
|
1356
|
-
<description>
|
|
1236
|
+
<example>foo.bar.com ESMTP Sendmail 8.13.5.20060308/8.13.5/Debian-3ubuntu1.1; Fri, 24 Jul 2009 01:41:21 -0700; (No UCE/UBE) logging access from: xyz.example.com(OK)-xyz.example.com [10.0.0.1]</example>
|
|
1237
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1238
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1239
|
+
<param pos="0" name="os.vendor" value="Ubuntu"/>
|
|
1240
|
+
<param pos="0" name="os.family" value="Linux"/>
|
|
1241
|
+
<param pos="0" name="os.device" value="General"/>
|
|
1242
|
+
<param pos="0" name="os.product" value="Linux"/>
|
|
1243
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1244
|
+
<param pos="1" name="host.name"/>
|
|
1245
|
+
<param pos="2" name="service.version"/>
|
|
1246
|
+
<param pos="3" name="system.time"/>
|
|
1247
|
+
</fingerprint>
|
|
1248
|
+
<fingerprint pattern="^([^ ]+) (?:E?SMTP )?Sendmail SMI-([^/]+)/(SMI-SVR4) ready at (.+)$">
|
|
1249
|
+
<description>
|
|
1357
1250
|
unknown
|
|
1358
1251
|
</description>
|
|
1359
|
-
|
|
1360
|
-
|
|
1361
|
-
|
|
1362
|
-
|
|
1363
|
-
|
|
1364
|
-
|
|
1365
|
-
|
|
1366
|
-
|
|
1367
|
-
|
|
1368
|
-
|
|
1369
|
-
|
|
1370
|
-
|
|
1371
|
-
|
|
1372
|
-
|
|
1373
|
-
|
|
1374
|
-
<description>
|
|
1252
|
+
<example>foo.bar.com Sendmail SMI-8.6/SMI-SVR4 ready at Sun, 29 Jul 2001 22:58:46 -0400</example>
|
|
1253
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1254
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1255
|
+
<param pos="0" name="os.vendor" value="Sun"/>
|
|
1256
|
+
<param pos="0" name="os.family" value="SunOS"/>
|
|
1257
|
+
<param pos="0" name="os.device" value="General"/>
|
|
1258
|
+
<param pos="0" name="os.product" value="Solaris"/>
|
|
1259
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1260
|
+
<param pos="1" name="host.name"/>
|
|
1261
|
+
<param pos="2" name="service.version"/>
|
|
1262
|
+
<param pos="3" name="sendmail.config.version"/>
|
|
1263
|
+
<param pos="4" name="system.time"/>
|
|
1264
|
+
</fingerprint>
|
|
1265
|
+
<fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^ ]+)/(linuxconf); (.+)$">
|
|
1266
|
+
<description>
|
|
1375
1267
|
unknown
|
|
1376
1268
|
</description>
|
|
1377
|
-
|
|
1378
|
-
|
|
1379
|
-
|
|
1380
|
-
|
|
1381
|
-
|
|
1382
|
-
|
|
1383
|
-
|
|
1384
|
-
|
|
1385
|
-
|
|
1386
|
-
|
|
1387
|
-
|
|
1388
|
-
|
|
1389
|
-
|
|
1390
|
-
|
|
1391
|
-
<description>
|
|
1269
|
+
<example>foo.bar.com ESMTP Sendmail 8.9.3/linuxconf; Sun, 29 Jul 2001 22:48:28 -0400</example>
|
|
1270
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1271
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1272
|
+
<param pos="0" name="os.family" value="Linux"/>
|
|
1273
|
+
<param pos="0" name="os.device" value="General"/>
|
|
1274
|
+
<param pos="0" name="os.product" value="Linux"/>
|
|
1275
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1276
|
+
<param pos="1" name="host.name"/>
|
|
1277
|
+
<param pos="2" name="service.version"/>
|
|
1278
|
+
<param pos="3" name="sendmail.config.version"/>
|
|
1279
|
+
<param pos="4" name="system.time"/>
|
|
1280
|
+
</fingerprint>
|
|
1281
|
+
<fingerprint pattern="^([^ ]+) ESMTP MetaInfo Sendmail ([^ ]+) Build ([^ ]+) \(Berkeley ([^ ]+)\)/([^;]+); (.+)$">
|
|
1282
|
+
<description>
|
|
1392
1283
|
unknown
|
|
1393
1284
|
</description>
|
|
1394
|
-
|
|
1395
|
-
|
|
1396
|
-
|
|
1397
|
-
|
|
1398
|
-
|
|
1399
|
-
|
|
1400
|
-
|
|
1401
|
-
|
|
1402
|
-
|
|
1403
|
-
|
|
1404
|
-
|
|
1405
|
-
|
|
1406
|
-
|
|
1407
|
-
|
|
1408
|
-
|
|
1285
|
+
<example>foo.bar.com ESMTP MetaInfo Sendmail 2.5 Build 2630 (Berkeley 8.8.6)/8.8.4; Mon, 30 Jul</example>
|
|
1286
|
+
<param pos="0" name="service.vendor" value="MetaInfo"/>
|
|
1287
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1288
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1289
|
+
<param pos="0" name="os.vendor" value="Microsoft"/>
|
|
1290
|
+
<param pos="0" name="os.family" value="Windows"/>
|
|
1291
|
+
<param pos="0" name="os.device" value="General"/>
|
|
1292
|
+
<param pos="0" name="os.product" value="Windows NT"/>
|
|
1293
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM"/>
|
|
1294
|
+
<param pos="1" name="host.name"/>
|
|
1295
|
+
<param pos="2" name="metainfo.version"/>
|
|
1296
|
+
<param pos="3" name="metainfo.version.version"/>
|
|
1297
|
+
<param pos="4" name="service.version"/>
|
|
1298
|
+
<param pos="5" name="sendmail.config.version"/>
|
|
1299
|
+
<param pos="6" name="system.time"/>
|
|
1409
1300
|
</fingerprint>
|
|
1410
|
-
|
|
1411
|
-
|
|
1412
|
-
<description>
|
|
1301
|
+
<fingerprint pattern="^([^ ]+) +ESMTP +Sendmail +([^ ]+\+[^ ]+) */ *([^ ]+\+[^ ]+); *(.+) \(.+\)$">
|
|
1302
|
+
<description>
|
|
1413
1303
|
sendmail where both daemon and config file are patched
|
|
1414
1304
|
</description>
|
|
1415
|
-
|
|
1416
|
-
|
|
1417
|
-
|
|
1418
|
-
|
|
1419
|
-
|
|
1420
|
-
|
|
1421
|
-
|
|
1422
|
-
|
|
1423
|
-
|
|
1424
|
-
|
|
1425
|
-
|
|
1426
|
-
<description>
|
|
1305
|
+
<example>foo.bar.com ESMTP Sendmail 8.9.3+3.4W/8.9.3+3.4W; Tue, 30 Jan 2001 20:40:09 -0500 (EST)</example>
|
|
1306
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1307
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1308
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1309
|
+
<param pos="1" name="host.name"/>
|
|
1310
|
+
<param pos="2" name="service.version"/>
|
|
1311
|
+
<param pos="3" name="sendmail.config.version"/>
|
|
1312
|
+
<param pos="4" name="system.time"/>
|
|
1313
|
+
</fingerprint>
|
|
1314
|
+
<fingerprint pattern="^([^ ]+) +ESMTP .*Sendmail +([^/ ]+) */ *([^/ ]+); *(.+)(?: \(.+\))?$">
|
|
1315
|
+
<description>
|
|
1427
1316
|
sendmail where neither daemon nor config file are patched, with and without timezone
|
|
1428
1317
|
</description>
|
|
1429
|
-
|
|
1430
|
-
|
|
1431
|
-
|
|
1432
|
-
|
|
1433
|
-
|
|
1434
|
-
|
|
1435
|
-
|
|
1436
|
-
|
|
1437
|
-
|
|
1438
|
-
|
|
1439
|
-
|
|
1440
|
-
|
|
1441
|
-
|
|
1442
|
-
|
|
1443
|
-
<description>
|
|
1318
|
+
<example host.name="example.com" service.version="8.8.8" sendmail.config.version="8.8.9">example.com ESMTP Sendmail 8.8.8/8.8.9; Wed, 21 Nov 2001 23:39:07 +0100 (CET)</example>
|
|
1319
|
+
<example host.name="example.com" service.version="8.8.8" sendmail.config.version="8.8.9">example.com ESMTP blah Sendmail 8.8.8/8.8.9; Wed, 21 Nov 2001 23:39:07 +0100 (CET)</example>
|
|
1320
|
+
<example host.name="example.com" service.version="8.10.2" sendmail.config.version="8.10.3">example.com ESMTP Sendmail 8.10.2/8.10.3; Mon, 10 Sep 2001 08:37:14 -0400</example>
|
|
1321
|
+
<example host.name="example.com" service.version="8.13.8" sendmail.config.version="8.13.9">example.com ESMTP foo-MTA Sendmail 8.13.8/8.13.9; Mon, 18 Apr 2011 08:52:38 -0700</example>
|
|
1322
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1323
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1324
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1325
|
+
<param pos="1" name="host.name"/>
|
|
1326
|
+
<param pos="2" name="service.version"/>
|
|
1327
|
+
<param pos="3" name="sendmail.config.version"/>
|
|
1328
|
+
<param pos="4" name="system.time"/>
|
|
1329
|
+
</fingerprint>
|
|
1330
|
+
<fingerprint pattern="^([^ ]+) +Sendmail ready\. *$">
|
|
1331
|
+
<description>
|
|
1444
1332
|
some old version of sendmail - TODO: figure out which versions this could be
|
|
1445
1333
|
</description>
|
|
1446
|
-
|
|
1447
|
-
|
|
1448
|
-
|
|
1449
|
-
|
|
1450
|
-
|
|
1451
|
-
|
|
1452
|
-
|
|
1453
|
-
<description>
|
|
1334
|
+
<example>mail.foo.bar Sendmail ready.</example>
|
|
1335
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1336
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1337
|
+
<param pos="1" name="host.name"/>
|
|
1338
|
+
</fingerprint>
|
|
1339
|
+
<fingerprint pattern="^([^ ]+) +ESMTP +Sendmail ([^ ]+) ready at *(.+) \(.+\)$">
|
|
1340
|
+
<description>
|
|
1454
1341
|
sendmail with daemon version only
|
|
1455
1342
|
</description>
|
|
1456
|
-
|
|
1457
|
-
|
|
1458
|
-
|
|
1459
|
-
|
|
1460
|
-
|
|
1461
|
-
|
|
1462
|
-
|
|
1463
|
-
|
|
1464
|
-
|
|
1465
|
-
|
|
1466
|
-
<description>
|
|
1343
|
+
<example>mail.foo.bar ESMTP Sendmail 8.8.8 ready at Tue, 6 Feb 2001 14:37:14 +0100 (CET)</example>
|
|
1344
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1345
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1346
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1347
|
+
<param pos="1" name="host.name"/>
|
|
1348
|
+
<param pos="2" name="service.version"/>
|
|
1349
|
+
<param pos="3" name="system.time"/>
|
|
1350
|
+
</fingerprint>
|
|
1351
|
+
<fingerprint pattern="^([^ ]+) +ESMTP +Sendmail ([^ /]+) \([^\)]+\) *(.+) \(.+\)$">
|
|
1352
|
+
<description>
|
|
1467
1353
|
unknown
|
|
1468
1354
|
</description>
|
|
1469
|
-
|
|
1470
|
-
|
|
1471
|
-
|
|
1472
|
-
|
|
1473
|
-
|
|
1474
|
-
|
|
1475
|
-
|
|
1476
|
-
|
|
1477
|
-
|
|
1478
|
-
<
|
|
1479
|
-
<description>
|
|
1355
|
+
<example>mail.foo.bar ESMTP Sendmail 8.11.1 (1.1.2.11/12Jul01-1016AM) Wed, 8 Jan 2003 11:21:22 +0100 (MET)</example>
|
|
1356
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1357
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1358
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1359
|
+
<param pos="1" name="host.name"/>
|
|
1360
|
+
<param pos="2" name="service.version"/>
|
|
1361
|
+
<param pos="3" name="system.time"/>
|
|
1362
|
+
</fingerprint>
|
|
1363
|
+
<fingerprint pattern="^([^ ]+) +ESMTP +Sendmail ([^ /]+) - \([^\)]+\)/[^ ]+;? *(.+) \(.+\)$">
|
|
1364
|
+
<description>
|
|
1480
1365
|
unknown
|
|
1481
1366
|
</description>
|
|
1482
|
-
|
|
1483
|
-
|
|
1484
|
-
|
|
1485
|
-
|
|
1486
|
-
|
|
1487
|
-
|
|
1488
|
-
|
|
1489
|
-
|
|
1490
|
-
|
|
1491
|
-
<
|
|
1492
|
-
<description>
|
|
1367
|
+
<example>foo.example.com ESMTP Sendmail 8.11.1 - (Revision 1.010)/8.9.3; Sat, 22 Jan 2011 10:08:35 -0500 (EST)</example>
|
|
1368
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1369
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1370
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1371
|
+
<param pos="1" name="host.name"/>
|
|
1372
|
+
<param pos="2" name="service.version"/>
|
|
1373
|
+
<param pos="3" name="system.time"/>
|
|
1374
|
+
</fingerprint>
|
|
1375
|
+
<fingerprint pattern="^([^ ]+) +ESMTP +Sendmail +(?:[^ ]+) +version +([^ ]+) +- +(?:[^;]+); +(.+) +\(.+\)$">
|
|
1376
|
+
<description>
|
|
1493
1377
|
unknown
|
|
1494
1378
|
</description>
|
|
1495
|
-
|
|
1496
|
-
|
|
1497
|
-
|
|
1498
|
-
|
|
1499
|
-
|
|
1500
|
-
|
|
1501
|
-
|
|
1502
|
-
|
|
1503
|
-
|
|
1504
|
-
|
|
1505
|
-
<description>
|
|
1379
|
+
<example>foo.example.com ESMTP Sendmail @(#)Sendmail version 8.13.3 - Revision 2.007 - 8 December 2008/8.8.6; Wed, 21 Jul 2010 11:17:01 -0400 (EDT)</example>
|
|
1380
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1381
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1382
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1383
|
+
<param pos="1" name="host.name"/>
|
|
1384
|
+
<param pos="2" name="service.version"/>
|
|
1385
|
+
<param pos="3" name="system.time"/>
|
|
1386
|
+
</fingerprint>
|
|
1387
|
+
<fingerprint pattern="^Sendmail ([^/]+)/([^/]+) ready on ([^ ]+)$">
|
|
1388
|
+
<description>
|
|
1506
1389
|
catch all for other versions of sendmail
|
|
1507
1390
|
</description>
|
|
1508
|
-
|
|
1509
|
-
|
|
1510
|
-
|
|
1511
|
-
|
|
1512
|
-
|
|
1513
|
-
|
|
1514
|
-
|
|
1515
|
-
|
|
1516
|
-
<description>
|
|
1391
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1392
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1393
|
+
<param pos="1" name="service.version"/>
|
|
1394
|
+
<param pos="2" name="sendmail.config.version"/>
|
|
1395
|
+
<param pos="3" name="host.name"/>
|
|
1396
|
+
</fingerprint>
|
|
1397
|
+
<fingerprint pattern="^([^ ]+) +ESMTP +Sendmail ready at (.+) \(.+\)$">
|
|
1398
|
+
<description>
|
|
1517
1399
|
catch all for other versions of sendmail
|
|
1518
1400
|
</description>
|
|
1519
|
-
|
|
1520
|
-
|
|
1521
|
-
|
|
1522
|
-
|
|
1523
|
-
|
|
1524
|
-
|
|
1525
|
-
|
|
1526
|
-
|
|
1527
|
-
<description>
|
|
1401
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1402
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1403
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1404
|
+
<param pos="1" name="host.name"/>
|
|
1405
|
+
<param pos="2" name="system.time"/>
|
|
1406
|
+
</fingerprint>
|
|
1407
|
+
<fingerprint pattern="^([^ ]+) +ESMTP +Sendmail ;.*$">
|
|
1408
|
+
<description>
|
|
1528
1409
|
catch all for other versions of sendmail
|
|
1529
1410
|
</description>
|
|
1530
|
-
|
|
1531
|
-
|
|
1532
|
-
|
|
1533
|
-
|
|
1534
|
-
|
|
1535
|
-
|
|
1536
|
-
<description>
|
|
1411
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1412
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1413
|
+
<param pos="1" name="host.name"/>
|
|
1414
|
+
</fingerprint>
|
|
1415
|
+
<fingerprint pattern="^([^ ]+) ESMTP Sendmail ready$">
|
|
1416
|
+
<description>
|
|
1537
1417
|
catch all for other versions of sendmail
|
|
1538
1418
|
</description>
|
|
1539
|
-
|
|
1540
|
-
|
|
1541
|
-
|
|
1542
|
-
|
|
1543
|
-
|
|
1544
|
-
|
|
1545
|
-
<description>
|
|
1419
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1420
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1421
|
+
<param pos="1" name="host.name"/>
|
|
1422
|
+
</fingerprint>
|
|
1423
|
+
<fingerprint pattern="^([^ ]+) Sendmail ([^/]+)/([^ ]+) ready at ([^;\.]+)$">
|
|
1424
|
+
<description>
|
|
1546
1425
|
catch all for other versions of sendmail
|
|
1547
1426
|
</description>
|
|
1548
|
-
|
|
1549
|
-
|
|
1550
|
-
|
|
1551
|
-
|
|
1552
|
-
|
|
1553
|
-
|
|
1554
|
-
|
|
1555
|
-
|
|
1556
|
-
|
|
1557
|
-
|
|
1558
|
-
<description>
|
|
1427
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1428
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1429
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1430
|
+
<param pos="1" name="host.name"/>
|
|
1431
|
+
<param pos="2" name="service.version"/>
|
|
1432
|
+
<param pos="3" name="sendmail.config.version"/>
|
|
1433
|
+
<param pos="4" name="system.time"/>
|
|
1434
|
+
</fingerprint>
|
|
1435
|
+
<fingerprint pattern="^([^ ]+) Sendmail ([^;]+); ([^;\.]+)$">
|
|
1436
|
+
<description>
|
|
1559
1437
|
catch all for other versions of sendmail
|
|
1560
1438
|
</description>
|
|
1561
|
-
|
|
1562
|
-
|
|
1563
|
-
|
|
1564
|
-
|
|
1565
|
-
|
|
1566
|
-
|
|
1567
|
-
|
|
1568
|
-
|
|
1569
|
-
|
|
1570
|
-
<description>
|
|
1439
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1440
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1441
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1442
|
+
<param pos="1" name="host.name"/>
|
|
1443
|
+
<param pos="2" name="service.version"/>
|
|
1444
|
+
<param pos="3" name="system.time"/>
|
|
1445
|
+
</fingerprint>
|
|
1446
|
+
<fingerprint pattern="^([^ ]+) ESMTP Sendmail$">
|
|
1447
|
+
<description>
|
|
1571
1448
|
catch all for other versions of sendmail
|
|
1572
1449
|
</description>
|
|
1573
|
-
|
|
1574
|
-
|
|
1575
|
-
|
|
1576
|
-
|
|
1577
|
-
|
|
1578
|
-
|
|
1579
|
-
<description>
|
|
1450
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1451
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1452
|
+
<param pos="1" name="host.name"/>
|
|
1453
|
+
</fingerprint>
|
|
1454
|
+
<fingerprint pattern="^(\S+) ESMTP Sendmail (\S{3}, \d{1,2} \S{3} \d{4} \d{2}:\d{2}:\d{2} \S+)$">
|
|
1455
|
+
<description>
|
|
1580
1456
|
catch all for other versions of sendmail, with a date/time
|
|
1581
1457
|
</description>
|
|
1582
|
-
|
|
1583
|
-
|
|
1584
|
-
|
|
1585
|
-
|
|
1586
|
-
|
|
1587
|
-
|
|
1588
|
-
|
|
1589
|
-
|
|
1590
|
-
|
|
1591
|
-
|
|
1592
|
-
|
|
1593
|
-
|
|
1594
|
-
|
|
1595
|
-
<fingerprint pattern="^([^ ]+) -- Server ESMTP \(Sun Internet Mail Server sims\.([^\.]+\.[^\.]+\.[^\.]+\.[^\.]+\.[^\.]+\.[^\.]+\.[^\.]+\.[^\.]+)\)$">
|
|
1596
|
-
<description>
|
|
1458
|
+
<example host.name="example.com">example.com ESMTP Sendmail Wed, 20 May 2015 17:17:56 -0600</example>
|
|
1459
|
+
<example host.name="example.com">example.com ESMTP Sendmail Wed, 5 Aug 2015 17:40:38 -0400</example>
|
|
1460
|
+
<param pos="0" name="service.family" value="Sendmail"/>
|
|
1461
|
+
<param pos="0" name="service.product" value="Sendmail"/>
|
|
1462
|
+
<param pos="1" name="host.name"/>
|
|
1463
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1464
|
+
<param pos="2" name="system.time"/>
|
|
1465
|
+
</fingerprint>
|
|
1466
|
+
<!-- Sun Internet Mail Server -->
|
|
1467
|
+
<!-- Sun Internet Mail Server sims\.([^\.]+)([^\.]+)([^\.]+)([^\.]+)([^\.]+)([^\.]+)([^\.]+)([^\.]+) -->
|
|
1468
|
+
<!-- these suckers can have LOTS of version numbers -->
|
|
1469
|
+
<fingerprint pattern="^([^ ]+) -- Server ESMTP \(Sun Internet Mail Server sims\.([^\.]+\.[^\.]+\.[^\.]+\.[^\.]+\.[^\.]+\.[^\.]+\.[^\.]+\.[^\.]+)\)$">
|
|
1470
|
+
<description>
|
|
1597
1471
|
220 smtp.foo.bar -- Server ESMTP (Sun Internet Mail Server sims.4.0.2000.10.12.16.25.p8)
|
|
1598
1472
|
</description>
|
|
1599
|
-
|
|
1600
|
-
|
|
1601
|
-
|
|
1602
|
-
|
|
1603
|
-
|
|
1604
|
-
|
|
1605
|
-
|
|
1606
|
-
|
|
1607
|
-
|
|
1608
|
-
|
|
1609
|
-
|
|
1610
|
-
|
|
1611
|
-
|
|
1612
|
-
<description>
|
|
1473
|
+
<param pos="0" name="service.vendor" value="Sun"/>
|
|
1474
|
+
<param pos="0" name="service.family" value="Internet Mail Server"/>
|
|
1475
|
+
<param pos="0" name="service.product" value="Internet Mail Server"/>
|
|
1476
|
+
<param pos="0" name="os.vendor" value="Sun"/>
|
|
1477
|
+
<param pos="0" name="os.family" value="Solaris"/>
|
|
1478
|
+
<param pos="0" name="os.device" value="General"/>
|
|
1479
|
+
<param pos="0" name="os.product" value="Solaris"/>
|
|
1480
|
+
<param pos="1" name="host.name"/>
|
|
1481
|
+
<param pos="2" name="service.version"/>
|
|
1482
|
+
</fingerprint>
|
|
1483
|
+
<!-- these suckers can have LOTS of version numbers -->
|
|
1484
|
+
<fingerprint pattern="^([^ ]+) -- Server ESMTP \(Sun Internet Mail Server sims\.([^\.]+\.[^\.]+\.[^\.]+\.[^\.]+\.[^\.]+\.[^\.]+\.[^\.]+)\)$">
|
|
1485
|
+
<description>
|
|
1613
1486
|
220 mercury.doc.ntu.ac.uk -- Server ESMTP (Sun Internet Mail Server sims.4.0.1999.06.13.00.20)
|
|
1614
1487
|
</description>
|
|
1615
|
-
|
|
1616
|
-
|
|
1617
|
-
|
|
1618
|
-
|
|
1619
|
-
|
|
1620
|
-
|
|
1621
|
-
|
|
1622
|
-
|
|
1623
|
-
|
|
1624
|
-
|
|
1625
|
-
|
|
1626
|
-
|
|
1627
|
-
|
|
1628
|
-
<description>
|
|
1488
|
+
<param pos="0" name="service.vendor" value="Sun"/>
|
|
1489
|
+
<param pos="0" name="service.family" value="Internet Mail Server"/>
|
|
1490
|
+
<param pos="0" name="service.product" value="Internet Mail Server"/>
|
|
1491
|
+
<param pos="0" name="os.vendor" value="Sun"/>
|
|
1492
|
+
<param pos="0" name="os.family" value="Solaris"/>
|
|
1493
|
+
<param pos="0" name="os.device" value="General"/>
|
|
1494
|
+
<param pos="0" name="os.product" value="Solaris"/>
|
|
1495
|
+
<param pos="1" name="host.name"/>
|
|
1496
|
+
<param pos="2" name="service.version"/>
|
|
1497
|
+
</fingerprint>
|
|
1498
|
+
<!-- SLMail with two version numbers -->
|
|
1499
|
+
<fingerprint pattern="^([^ ]+) S[mM][tT][pP] Server SL[mM]ail v?([^ ]+\.[^ ]+) Ready ESMTP spoken here *$">
|
|
1500
|
+
<description>
|
|
1629
1501
|
Seattle Labs SLMail server for Windows NT/2k (v2.7 runs on Win9x)
|
|
1630
1502
|
http://serverwatch.internet.com/reviews/mail-slmail.html
|
|
1631
1503
|
http://www.seattlelab.com/
|
|
1632
1504
|
example: 220 mail2.webgeneral.com Smtp Server SLMail v2.7 Ready ESMTP spoken here
|
|
1633
1505
|
</description>
|
|
1634
|
-
|
|
1635
|
-
|
|
1636
|
-
|
|
1637
|
-
|
|
1638
|
-
|
|
1639
|
-
|
|
1640
|
-
|
|
1641
|
-
|
|
1642
|
-
|
|
1643
|
-
<description>
|
|
1506
|
+
<param pos="0" name="service.vendor" value="Seattle Labs"/>
|
|
1507
|
+
<param pos="0" name="service.family" value="SLMail"/>
|
|
1508
|
+
<param pos="0" name="service.product" value="SLMail"/>
|
|
1509
|
+
<param pos="1" name="host.name"/>
|
|
1510
|
+
<param pos="2" name="service.version"/>
|
|
1511
|
+
</fingerprint>
|
|
1512
|
+
<!-- SLMail with three version numbers -->
|
|
1513
|
+
<fingerprint pattern="^([^ ]+) S[mM][tT][pP] Server SL[mM]ail v?([^ ]+\.[^ ]+\.[^ ]+) Ready ESMTP spoken here *$">
|
|
1514
|
+
<description>
|
|
1644
1515
|
Seattle Labs SLMail server for Windows NT/2k (v2.7 runs on Win9x)
|
|
1645
1516
|
http://serverwatch.internet.com/reviews/mail-slmail.html
|
|
1646
1517
|
http://www.seattlelab.com/
|
|
1647
1518
|
example: 220 wl004.pbx.web-light.net SMTP Server SLmail 3.2.3113 Ready ESMTP spoken here
|
|
1648
1519
|
</description>
|
|
1649
|
-
|
|
1650
|
-
|
|
1651
|
-
|
|
1652
|
-
|
|
1653
|
-
|
|
1654
|
-
|
|
1655
|
-
|
|
1656
|
-
|
|
1657
|
-
|
|
1658
|
-
<description>
|
|
1520
|
+
<param pos="0" name="service.vendor" value="Seattle Labs"/>
|
|
1521
|
+
<param pos="0" name="service.family" value="SLMail"/>
|
|
1522
|
+
<param pos="0" name="service.product" value="SLMail"/>
|
|
1523
|
+
<param pos="1" name="host.name"/>
|
|
1524
|
+
<param pos="2" name="service.version"/>
|
|
1525
|
+
</fingerprint>
|
|
1526
|
+
<!-- SLMail with four version numbers -->
|
|
1527
|
+
<fingerprint pattern="^([^ ]+) S[mM][tT][pP] Server SL[mM]ail v?([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+) Ready ESMTP spoken here *$">
|
|
1528
|
+
<description>
|
|
1659
1529
|
Seattle Labs SLMail server for Windows NT/2k (v2.7 runs on Win9x)
|
|
1660
1530
|
http://serverwatch.internet.com/reviews/mail-slmail.html
|
|
1661
1531
|
http://www.seattlelab.com/
|
|
1662
1532
|
example: 220 mail2.webgeneral.com Smtp Server SLMail v2.7 Ready ESMTP spoken here
|
|
1663
1533
|
</description>
|
|
1664
|
-
|
|
1665
|
-
|
|
1666
|
-
|
|
1667
|
-
|
|
1668
|
-
|
|
1669
|
-
|
|
1670
|
-
|
|
1671
|
-
|
|
1672
|
-
<description>
|
|
1534
|
+
<param pos="0" name="service.vendor" value="Seattle Labs"/>
|
|
1535
|
+
<param pos="0" name="service.family" value="SLMail"/>
|
|
1536
|
+
<param pos="0" name="service.product" value="SLMail"/>
|
|
1537
|
+
<param pos="1" name="host.name"/>
|
|
1538
|
+
<param pos="2" name="service.version"/>
|
|
1539
|
+
</fingerprint>
|
|
1540
|
+
<fingerprint pattern="^([^ ]+) +ESMTP Symantec Mail Security$">
|
|
1541
|
+
<description>
|
|
1673
1542
|
Symantec Mail Security for SMTP
|
|
1674
1543
|
</description>
|
|
1675
|
-
|
|
1676
|
-
|
|
1677
|
-
|
|
1678
|
-
|
|
1679
|
-
|
|
1680
|
-
|
|
1681
|
-
<description>
|
|
1544
|
+
<param pos="0" name="service.vendor" value="Symantec"/>
|
|
1545
|
+
<param pos="0" name="service.product" value="Symantec Mail Security for SMTP"/>
|
|
1546
|
+
<param pos="1" name="host.name"/>
|
|
1547
|
+
</fingerprint>
|
|
1548
|
+
<fingerprint pattern="^([^ ]+) +VOPmail ESMTP Receiver Version ([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+) Ready *$">
|
|
1549
|
+
<description>
|
|
1682
1550
|
VOPMail http://www.vircom.com/en/products/vopmail/vopmail.shtml
|
|
1683
1551
|
example: 220 compudata.com.ar VOPmail ESMTP Receiver Version 4.0.179.0 Ready
|
|
1684
1552
|
</description>
|
|
1685
|
-
|
|
1686
|
-
|
|
1687
|
-
|
|
1688
|
-
|
|
1689
|
-
|
|
1690
|
-
|
|
1691
|
-
|
|
1692
|
-
|
|
1693
|
-
<description>
|
|
1553
|
+
<param pos="0" name="service.vendor" value="Vircom"/>
|
|
1554
|
+
<param pos="0" name="service.family" value="VOPMail"/>
|
|
1555
|
+
<param pos="0" name="service.product" value="VOPMail"/>
|
|
1556
|
+
<param pos="1" name="host.name"/>
|
|
1557
|
+
<param pos="2" name="service.version"/>
|
|
1558
|
+
</fingerprint>
|
|
1559
|
+
<fingerprint pattern="^([^ ]+) VPOP3 SMTP Server Ready *$">
|
|
1560
|
+
<description>
|
|
1694
1561
|
VPOP3 Email server: http://www.pscs.co.uk/products/vpop3/index.html
|
|
1695
1562
|
example: 220 mail.sbm.com.ar VPOP3 SMTP Server Ready
|
|
1696
1563
|
</description>
|
|
1697
|
-
|
|
1698
|
-
|
|
1699
|
-
|
|
1700
|
-
|
|
1701
|
-
|
|
1702
|
-
|
|
1703
|
-
|
|
1704
|
-
<description>
|
|
1564
|
+
<param pos="0" name="service.vendor" value="Paul Smith Computer Services"/>
|
|
1565
|
+
<param pos="0" name="service.family" value="VPOP3"/>
|
|
1566
|
+
<param pos="0" name="service.product" value="VPOP3"/>
|
|
1567
|
+
<param pos="1" name="host.name"/>
|
|
1568
|
+
</fingerprint>
|
|
1569
|
+
<fingerprint pattern="^([^ ]+) WebShield SMTP V([^ ]+\.[^ ]+) Network Associates.*Ready at (.+) *$">
|
|
1570
|
+
<description>
|
|
1705
1571
|
http://www.mcafeeb2b.com/products/webshield-smtp/default.asp
|
|
1706
1572
|
example:220 smtp.foo.bar WebShield SMTP V4.5 Network Associates, Inc. Ready at Fri Jun 22 02:36:23 2001
|
|
1707
1573
|
</description>
|
|
1708
|
-
|
|
1709
|
-
|
|
1710
|
-
|
|
1711
|
-
|
|
1712
|
-
|
|
1713
|
-
|
|
1714
|
-
|
|
1715
|
-
|
|
1716
|
-
|
|
1717
|
-
|
|
1718
|
-
<description>
|
|
1574
|
+
<param pos="0" name="service.vendor" value="McAfee"/>
|
|
1575
|
+
<param pos="0" name="service.family" value="WebShield"/>
|
|
1576
|
+
<param pos="0" name="service.product" value="WebShield"/>
|
|
1577
|
+
<param pos="0" name="system.time.format" value="EEE dd MMM yyyy HH:mm:ss zzz"/>
|
|
1578
|
+
<param pos="1" name="host.name"/>
|
|
1579
|
+
<param pos="2" name="service.version"/>
|
|
1580
|
+
<param pos="3" name="system.time"/>
|
|
1581
|
+
</fingerprint>
|
|
1582
|
+
<fingerprint pattern="^([^ ]+) WebShield SMTP V([^ ]+\.[^ ]+) ([^ ]+) Network Associates.*Ready at (.+) *$">
|
|
1583
|
+
<description>
|
|
1719
1584
|
http://www.mcafeeb2b.com/products/webshield-smtp/default.asp
|
|
1720
1585
|
example:220 wsigate WebShield SMTP V4.5 MR1 Network Associates, Inc. Ready at Sun Jul 29 22:47:44 2001
|
|
1721
1586
|
</description>
|
|
1722
|
-
|
|
1723
|
-
|
|
1724
|
-
|
|
1725
|
-
|
|
1726
|
-
|
|
1727
|
-
|
|
1728
|
-
|
|
1729
|
-
|
|
1730
|
-
|
|
1731
|
-
|
|
1732
|
-
|
|
1733
|
-
<description>
|
|
1587
|
+
<param pos="0" name="service.vendor" value="McAfee"/>
|
|
1588
|
+
<param pos="0" name="service.family" value="WebShield"/>
|
|
1589
|
+
<param pos="0" name="service.product" value="WebShield"/>
|
|
1590
|
+
<param pos="0" name="system.time.format" value="EEE dd MMM yyyy HH:mm:ss zzz"/>
|
|
1591
|
+
<param pos="1" name="host.name"/>
|
|
1592
|
+
<param pos="2" name="service.version"/>
|
|
1593
|
+
<param pos="3" name="service.version.version"/>
|
|
1594
|
+
<param pos="4" name="system.time"/>
|
|
1595
|
+
</fingerprint>
|
|
1596
|
+
<fingerprint pattern="^([^ ]+) McAfee WebShield ASaP v([^ ]+\.[^ ]+\.[^ ]+): (.+) *$">
|
|
1597
|
+
<description>
|
|
1734
1598
|
McAfee Webshield ASaP is a combination hardware/software platform,
|
|
1735
1599
|
basically consisting of a 1U Linux rackmount box with McAfee's filtering software
|
|
1736
1600
|
http://www.mcafeeb2b.com/services/webshield-asap/faq.asp
|
|
1737
1601
|
example: 220 smtp.foo.bar McAfee WebShield ASaP v1.0.1: Sun, 29 Jul 2001 22:46:18 -0700
|
|
1738
1602
|
</description>
|
|
1739
|
-
|
|
1740
|
-
|
|
1741
|
-
|
|
1742
|
-
|
|
1743
|
-
|
|
1744
|
-
|
|
1745
|
-
|
|
1746
|
-
|
|
1747
|
-
|
|
1748
|
-
|
|
1749
|
-
|
|
1750
|
-
|
|
1751
|
-
|
|
1752
|
-
|
|
1753
|
-
<description>
|
|
1603
|
+
<param pos="0" name="service.vendor" value="McAfee"/>
|
|
1604
|
+
<param pos="0" name="service.family" value="WebShield"/>
|
|
1605
|
+
<param pos="0" name="service.product" value="WebShield"/>
|
|
1606
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1607
|
+
<param pos="0" name="os.vendor" value="McAfee"/>
|
|
1608
|
+
<param pos="0" name="os.family" value="Linux"/>
|
|
1609
|
+
<param pos="0" name="os.device" value="General"/>
|
|
1610
|
+
<param pos="0" name="os.product" value="Linux"/>
|
|
1611
|
+
<param pos="1" name="host.name"/>
|
|
1612
|
+
<param pos="2" name="service.version"/>
|
|
1613
|
+
<param pos="3" name="system.time"/>
|
|
1614
|
+
</fingerprint>
|
|
1615
|
+
<fingerprint pattern="^([^ ]+) McAfee VirusScreen ASaP v([^ ]+\.[^ ]+): (.+) *$">
|
|
1616
|
+
<description>
|
|
1754
1617
|
example: 220 smtp.foo.bar McAfee VirusScreen ASaP v1.1: Sun, 20 Jul 2003 09:20:52 -0700
|
|
1755
1618
|
</description>
|
|
1756
|
-
|
|
1757
|
-
|
|
1758
|
-
|
|
1759
|
-
|
|
1760
|
-
|
|
1761
|
-
|
|
1762
|
-
|
|
1763
|
-
|
|
1764
|
-
|
|
1765
|
-
|
|
1766
|
-
|
|
1767
|
-
|
|
1768
|
-
|
|
1769
|
-
|
|
1770
|
-
<description>
|
|
1619
|
+
<param pos="0" name="service.vendor" value="McAfee"/>
|
|
1620
|
+
<param pos="0" name="service.family" value="WebShield"/>
|
|
1621
|
+
<param pos="0" name="service.product" value="WebShield"/>
|
|
1622
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1623
|
+
<param pos="0" name="os.vendor" value="McAfee"/>
|
|
1624
|
+
<param pos="0" name="os.family" value="Linux"/>
|
|
1625
|
+
<param pos="0" name="os.device" value="General"/>
|
|
1626
|
+
<param pos="0" name="os.product" value="Linux"/>
|
|
1627
|
+
<param pos="1" name="host.name"/>
|
|
1628
|
+
<param pos="2" name="service.version"/>
|
|
1629
|
+
<param pos="3" name="system.time"/>
|
|
1630
|
+
</fingerprint>
|
|
1631
|
+
<fingerprint pattern="^([^ ]+) ESMTP - WinRoute Pro ([^ ]+\.[^ ]+) *$">
|
|
1632
|
+
<description>
|
|
1771
1633
|
WinRoute Pro, runs on 9x/NT/2k
|
|
1772
1634
|
http://www.tinysoftware.com/winpro.php
|
|
1773
1635
|
example: 220 unspecified.host ESMTP - WinRoute Pro 4.0
|
|
1774
1636
|
</description>
|
|
1775
|
-
|
|
1776
|
-
|
|
1777
|
-
|
|
1778
|
-
|
|
1779
|
-
|
|
1780
|
-
|
|
1781
|
-
|
|
1782
|
-
<description>
|
|
1637
|
+
<param pos="0" name="service.family" value="WinRoute"/>
|
|
1638
|
+
<param pos="0" name="service.product" value="WinRoute"/>
|
|
1639
|
+
<param pos="1" name="host.name"/>
|
|
1640
|
+
<param pos="2" name="service.version"/>
|
|
1641
|
+
</fingerprint>
|
|
1642
|
+
<fingerprint pattern="^([^ ]+) ZMailer Server ([^ ]+\.[^ ]+\.[^ ]+) #([^ ]) ESMTP ready at (.+) *$">
|
|
1643
|
+
<description>
|
|
1783
1644
|
ZMailer http://www.zmailer.org/technical.html
|
|
1784
1645
|
example: 220 dedos.pert.com.ar ZMailer Server 2.99.54 #2 ESMTP ready at Tue, 6 Feb 2001 10:42:08 -0300
|
|
1785
1646
|
</description>
|
|
1786
|
-
|
|
1787
|
-
|
|
1788
|
-
|
|
1789
|
-
|
|
1790
|
-
|
|
1791
|
-
|
|
1792
|
-
|
|
1793
|
-
|
|
1794
|
-
|
|
1795
|
-
|
|
1796
|
-
|
|
1797
|
-
<description>
|
|
1647
|
+
<param pos="0" name="service.vendor" value="ZMailer"/>
|
|
1648
|
+
<param pos="0" name="service.family" value="ZMailer"/>
|
|
1649
|
+
<param pos="0" name="service.product" value="ZMailer"/>
|
|
1650
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1651
|
+
<param pos="1" name="host.name"/>
|
|
1652
|
+
<param pos="2" name="service.version"/>
|
|
1653
|
+
<param pos="3" name="service.version.version"/>
|
|
1654
|
+
<param pos="4" name="system.time"/>
|
|
1655
|
+
</fingerprint>
|
|
1656
|
+
<fingerprint pattern="^([^ ]+) ZMailer Server ([^ ]+\.[^ ]+\.[^ ]+) #([^ ]) ESMTP\+IDENT ready at (.+) *$">
|
|
1657
|
+
<description>
|
|
1798
1658
|
ZMailer server that supports IDENT
|
|
1799
1659
|
</description>
|
|
1800
|
-
|
|
1801
|
-
|
|
1802
|
-
|
|
1803
|
-
|
|
1804
|
-
|
|
1805
|
-
|
|
1806
|
-
|
|
1807
|
-
|
|
1808
|
-
|
|
1809
|
-
|
|
1810
|
-
|
|
1811
|
-
<
|
|
1812
|
-
|
|
1813
|
-
|
|
1814
|
-
|
|
1815
|
-
|
|
1816
|
-
|
|
1817
|
-
|
|
1818
|
-
<fingerprint pattern="^([^ ]+) E?SMTP(?: (?:Service )?Ready\.?)?$" flags="REG_ICASE">
|
|
1819
|
-
<description>
|
|
1660
|
+
<param pos="0" name="service.vendor" value="ZMailer"/>
|
|
1661
|
+
<param pos="0" name="service.family" value="ZMailer"/>
|
|
1662
|
+
<param pos="0" name="service.product" value="ZMailer"/>
|
|
1663
|
+
<param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
|
|
1664
|
+
<param pos="0" name="zmailer.ident" value="yes"/>
|
|
1665
|
+
<param pos="1" name="host.name"/>
|
|
1666
|
+
<param pos="2" name="service.version"/>
|
|
1667
|
+
<param pos="3" name="service.version.version"/>
|
|
1668
|
+
<param pos="4" name="system.time"/>
|
|
1669
|
+
</fingerprint>
|
|
1670
|
+
<fingerprint pattern="^(\S+) E?SMTP Perl" flags="REG_ICASE">
|
|
1671
|
+
<description>Some simple PERL SMTP server</description>
|
|
1672
|
+
<example host.name="example.com">example.com ESMTP Perl</example>
|
|
1673
|
+
<param pos="0" name="service.product" value="Perl"/>
|
|
1674
|
+
<param pos="1" name="host.name"/>
|
|
1675
|
+
</fingerprint>
|
|
1676
|
+
<fingerprint pattern="^([^ ]+) E?SMTP(?: (?:Service )?Ready\.?)?$" flags="REG_ICASE">
|
|
1677
|
+
<description>
|
|
1820
1678
|
catch all for daemons that have no distinguishing fingerprint whatsoever
|
|
1821
1679
|
</description>
|
|
1822
|
-
|
|
1823
|
-
|
|
1824
|
-
|
|
1825
|
-
|
|
1826
|
-
|
|
1827
|
-
|
|
1828
|
-
|
|
1680
|
+
<example host.name="example.com">example.com ESMTP</example>
|
|
1681
|
+
<example host.name="example.com">example.com ESMTP Ready</example>
|
|
1682
|
+
<example host.name="example.com">example.com SMTP</example>
|
|
1683
|
+
<example host.name="example.com">example.com ESMTP Service ready</example>
|
|
1684
|
+
<param pos="0" name="service.product" value="Unknown"/>
|
|
1685
|
+
<param pos="1" name="host.name"/>
|
|
1686
|
+
</fingerprint>
|
|
1829
1687
|
</fingerprints>
|